Vercel
Vercel Connect Now Mints a Separate Stripe Key for Each Agent
Vercel Connect can create a restricted Stripe API key per agent or task, so agents stop running on a full-access secret key. Vercel announced it Oct. 23.
Topic
Security
30 articles tagged Security.
Vercel
Node.js Brotli Bug Allows RCE, and Vercel's WAF Only Covers Inbound
Node.js fixed a high-severity Brotli decoder flaw, CVE-2026-111497. Vercel's WAF blocks inbound attacks but not responses a function fetches.
Supabase
Supabase Cuts Default Data API Access on All Projects Oct. 30
New tables in public stop being reachable over Supabase's Data API on existing projects Oct. 30. Migrations that skip GRANT statements will start failing.
Vercel
Next.js Patches Two Critical RCEs, One With No Workaround
Next.js 16.4.1 and 15.5.28 fix two unauthenticated RCEs and a Server Actions DoS. Netlify says its hosting limits the damage.
Supabase
Supabase Drops Four TLS 1.2 Ciphers on Its APIs as Soon as Nov. 10
Supabase will stop offering four CBC-mode TLS 1.2 ciphers on project HTTP APIs. Clients that support nothing newer will lose access to Auth, Storage and more.
Supabase
Supabase Scoped Access Tokens Reach GA, and MCP Now Honors Them
Supabase scoped personal access tokens went GA Oct. 6. The MCP server now checks token permissions, closing the gap that left AI agents on full-access tokens.
Netlify
Netlify Functions Can Now See Who Is Visiting a Protected Site
Netlify added context.user to Functions and Edge Functions on Oct. 7, exposing the signed-in team member's ID, email and expiry on protected sites.
Vercel
Vercel Confirms a KVM Zero-Day Found by Its Sandbox Bounty
A researcher says he escaped a guest VM to host root. Vercel CEO Guillermo Rauch confirmed the KVM zero-day and promised a full write-up.
Supabase
Supabase Patches 44 Postgres CVEs, Some Fixes Need Your Action
Supabase rolls Postgres 15.19/17.11 out to every project starting today, closing 44 CVEs and flagging four breaking changes that need manual follow-up.
Firebase
Firebase Ships Replay Protection, iOS Apps Can't Use It Yet
Firebase's Admin SDKs finished shipping App Check replay protection, but a FlutterFire bug stops iOS and macOS from getting the short-lived tokens it needs.
Vercel
Next.js ImageResponse Bug Forces an Off-Schedule Critical Patch
Next.js shipped an unscheduled critical RCE patch for ImageResponse (CVSS 9.5), breaking the monthly security cadence Vercel set up in July.
Vercel
Vercel Password Protection Now Costs $20 a Project, Not $150
Vercel replaced its $150-a-month team-wide add-on with $20-per-project Password Protection pricing on Pro, ending a bundle that priced every project at once.
Vercel
Vercel Opens a Private Lane to AWS Databases for Pro Teams
Vercel brings AWS PrivateLink to Pro and Enterprise, letting Functions reach RDS, Aurora and Neon without a public-internet hop.
Vercel
Next.js Patches Two Unauthenticated RCEs in a Single Release
Two critical unauthenticated RCE bugs, one in AVIF image handling and one Windows-only, forced Next.js to patch a day early.
Vercel
Vercel Puts $1M on the Line to Prove Its Sandbox Holds
Vercel is offering hackers up to $50,000 per bug to break Sandbox isolation, weeks after OpenAI agents escaped a sandbox and breached Hugging Face.
Netlify
Netlify SSO Sign-In No Longer Needs a Team ID
Netlify's SSO login now routes on email domain alone, dropping the team ID field that locked out anyone who forgot it.
Firebase
Firebase App Check Brings reCAPTCHA Enterprise to Mobile Apps
Firebase App Check added reCAPTCHA Enterprise as an attestation option for Android, Apple platforms and Flutter, matching the option web apps already had.
Supabase
Supabase Finally Lets You Scope a Personal Access Token
Supabase's alpha for scoped personal access tokens, live since August 10, closes a nearly three-year-old gap where any token controlled the whole account.
Vercel
Vercel Cuts Off GitHub and Google Logins for Enterprise Teams
Vercel's Enterprise Managed Users reached general availability August 11, forcing SAML-only sign-in and directory-managed accounts on company domains.
Vercel
Vercel Patches Sandbox Bug That Let Code Fake Tool Calls
A flaw in Vercel AI SDK's Codex and OpenCode harnesses let sandboxed code invoke host tools without the model ever generating the call.
Supabase
Supabase Stops Honoring Your Pinned Extension Versions
Starting August 5, Supabase ignores explicit version numbers on Postgres extensions and installs the default version instead, closing a security gap.
Vercel
Vercel Puts Internal Apps and AI Agents Behind Your Identity Provider
Vercel Passport reached general availability July 31, gating internal apps and AI agents behind Okta, Entra ID, Auth0 or any OIDC provider.
Netlify
Netlify Makes New Projects Private by Default, Not Existing Ones
New Netlify teams on Credit-based plans now get private projects automatically. Teams that signed up before July 28 keep the old public-by-default behavior.
Netlify
React Router 7.18 Fixes Two Bugs Its Own Patches Missed
React Router 7.18.0 closes a DoS in the manifest endpoint and an open-redirect bypass, both follow-ups to fixes shipped earlier in 2026 that didn't fully hold.
Vercel
Next.js Now Warns You a Patch Is Coming Before It Says Why
Vercel's new Next.js Security Release Program pre-announces patch dates and severity, then ships. Its first drop fixed 9 bugs, 4 of them high severity.
Netlify
Netlify Narrows Nine New Next.js Bugs Down to the One That Matters
Next.js's first monthly security release patched nine bugs. Netlify's own changelog tells customers which one actually reaches their builds.
Netlify
Netlify Flags a Third Round of React Router Security Bugs
Netlify's changelog warns of five new React Router CVEs fixed in 7.18.0, the third disclosure round in two months, as a national CERT tells sites to patch now.
Vercel
Vercel's AI SDK Now Catches MCP Tools That Change After Approval
Vercel's AI SDK adds fingerprintTools and detectToolDrift to catch MCP servers that silently swap a tool's description or schema after an agent trusts it.
Vercel
Vercel Stops Printing Your Secrets Into Build Logs
Vercel now masks Sensitive Environment Variable values in build output automatically, closing a leak into logs teams routinely share and store.
Vercel
Vercel Redacts Build-Log Secrets After Its April Breach
Vercel now masks long Sensitive environment variable values in build logs, closing a leak path the April Context.ai breach didn't touch.