A Note on Vercel's April 2026 Security Incident

Hi everyone — quick transparency note. Like many web shops, Popproxx builds client projects and hosts them on Vercel, a platform we trust for its speed, reliability, and security posture. On April 19, 2026, Vercel disclosed a security incident involving unauthorized access to some of its internal systems, and on April 20 it emailed customers the notice below. That notice said that, at the time, Vercel had no reason to believe our Vercel credentials or personal data had been compromised, and that its services remained operational. That day, out of an abundance of caution, we began reviewing account activity, rotating environment variables on active projects, and monitoring Vercel’s Security Bulletin for further updates. Vercel has posted its later findings on that bulletin. We wanted to share the notice here verbatim so our clients can see exactly what we saw.

Vercel’s notice, reproduced verbatim (email footer removed):

We have discovered a security incident that involved unauthorized access to certain internal Vercel systems. We are actively investigating and have engaged incident response experts to help with investigation and remediation.

Initially, we identified a limited subset of customers whose Vercel credentials were compromised. We reached out to that subset and recommended that they rotate their credentials immediately.

At this time, we do not have reason to believe that your Vercel credentials or personal data have been compromised.

We continue to investigate whether any data was exfiltrated and will contact customers if we discover further evidence of compromise. We’ve deployed extensive protective measures and monitoring, and our services remain operational.

We recommend that all Vercel customers follow the Security Bulletin closely, which we will update regularly. Here are some best practices you should follow:

• Review the activity log for any suspicious account activity
• Review and rotate environment variables used in your projects
• Take advantage of the sensitive environment variables feature