Vercel
Vercel Puts $1M on the Line to Prove Its Sandbox Holds
Vercel is offering hackers up to $50,000 per bug to break Sandbox isolation, weeks after OpenAI agents escaped a sandbox and breached Hugging Face.
Topic
Security
13 articles tagged Security.
Netlify
Netlify SSO Sign-In No Longer Needs a Team ID
Netlify's SSO login now routes on email domain alone, dropping the team ID field that locked out anyone who forgot it.
Firebase
Firebase App Check Brings reCAPTCHA Enterprise to Mobile Apps
Firebase App Check added reCAPTCHA Enterprise as an attestation option for Android, Apple platforms and Flutter, matching the option web apps already had.
Supabase
Supabase Finally Lets You Scope a Personal Access Token
Supabase's alpha for scoped personal access tokens, live since August 10, closes a nearly three-year-old gap where any token controlled the whole account.
Vercel
Vercel Cuts Off GitHub and Google Logins for Enterprise Teams
Vercel's Enterprise Managed Users reached general availability August 11, forcing SAML-only sign-in and directory-managed accounts on company domains.
Vercel
Vercel Patches Sandbox Bug That Let Code Fake Tool Calls
A flaw in Vercel AI SDK's Codex and OpenCode harnesses let sandboxed code invoke host tools without the model ever generating the call.
Supabase
Supabase Stops Honoring Your Pinned Extension Versions
Starting August 5, Supabase ignores explicit version numbers on Postgres extensions and installs the default version instead, closing a security gap.
Vercel
Vercel Puts Internal Apps and AI Agents Behind Your Identity Provider
Vercel Passport reached general availability July 31, gating internal apps and AI agents behind Okta, Entra ID, Auth0 or any OIDC provider.
Netlify
Netlify Makes New Projects Private by Default, Not Existing Ones
New Netlify teams on Credit-based plans now get private projects automatically. Teams that signed up before July 28 keep the old public-by-default behavior.
Netlify
React Router 7.18 Fixes Two Bugs Its Own Patches Missed
React Router 7.18.0 closes a DoS in the manifest endpoint and an open-redirect bypass, both follow-ups to fixes shipped earlier in 2026 that didn't fully hold.
Vercel
Next.js Now Warns You a Patch Is Coming Before It Says Why
Vercel's new Next.js Security Release Program pre-announces patch dates and severity, then ships. Its first drop fixed 9 bugs, 4 of them high severity.
Vercel
Vercel's AI SDK Now Catches MCP Tools That Change After Approval
Vercel's AI SDK adds fingerprintTools and detectToolDrift to catch MCP servers that silently swap a tool's description or schema after an agent trusts it.
Vercel
Vercel Stops Printing Your Secrets Into Build Logs
Vercel now masks Sensitive Environment Variable values in build output automatically, closing a leak into logs teams routinely share and store.