Vercel has partnered with Truffle Security to expand automated detection and revocation of publicly exposed Vercel tokens.
Revoking exposed credentials helps prevent unauthorized access to your projects and unexpected costs from unauthorized use of services such as Vercel Sandbox and Vercel AI Gateway. If your token is revoked, you’ll receive an email from us explaining why.
Truffle Security reports tokens exposed in public sources including GitHub, GitLab, Docker, npm, PyPI, Hugging Face, Android APKs, and Firefox Add-ons. Vercel has revoked hundreds of tokens reported by Truffle Security.
A separate Vercel scanner now checks each new monthly Common Crawl dataset of public web pages and automatically revokes any exposed Vercel tokens it finds.
Learn more about creating tokens, setting their scopes, and managing them in the access token documentation.