Vercel token scanning expands to more public sources

Vercel partnered with Truffle Security to expand automated detection and revocation of publicly exposed Vercel tokens, and has already revoked hundreds of tokens reported by Truffle Security across sources including GitHub, GitLab, Docker, npm, PyPI, Hugging Face, Android APKs, and Firefox Add-ons. A separate Vercel scanner now checks each new monthly Common Crawl dataset of public web pages and automatically revokes any exposed Vercel tokens it finds. Vercel said revoking exposed credentials prevents unauthorized access to projects and unexpected costs from unauthorized use of services such as Vercel Sandbox and Vercel AI Gateway, and that affected users receive an email explaining the revocation.

Vercel has partnered with Truffle Security https://trufflesecurity.com/secrets-revocation-program to expand automated detection and revocation of publicly exposed Vercel tokens. Revoking exposed credentials helps prevent unauthorized access to your projects and unexpected costs from unauthorized use of services such as Vercel Sandbox https://vercel.com/docs/sandbox and Vercel AI Gateway https://vercel.com/docs/ai-gateway/authentication-and-byok . If your token is revoked, you’ll receive an email from us explaining why. Truffle Security reports tokens exposed in public sources including GitHub, GitLab, Docker, npm, PyPI, Hugging Face, Android APKs, and Firefox Add-ons. Vercel has revoked hundreds of tokens reported by Truffle Security. A separate Vercel scanner now checks each new monthly Common Crawl https://commoncrawl.org/ dataset of public web pages and automatically revokes any exposed Vercel tokens it finds. Learn more about creating tokens, setting their scopes, and managing them in the access token documentation https://vercel.com/docs/accounts/access-tokens .