⌘K
system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.
Phamthikimtho1957 4759 I have already submitted a detailed report through vercel.com/abuse over a week ago (Ticket ID: TNS_01c469jXvaN0RuDa), but no action has been taken and the malicious site remains active. Since the official channel has not yielded any response or mitigation, I am reaching out here to ask that your team internally locate and escalate Ticket TNS_01c469jXvaN0RuDa to your Security Engineers immediately.
Phamthikimtho1957 4759 My apologies for tagging you directly, @amyegan! However, since this case has been pending for over a week, I would really appreciate it if you could help pass ticket TNS_01c469jXvaN0RuDa to the security team for urgent review. Thank you so much for your assistance
Amy Egan Hey @paulmain79. Do you have a support case open? The community isn't able to issue refunds. That kind of thing is limited to the support team. If you don't have a case yet, please open one at vercel.com/help so the support team can assist!
Paulmain79 Hi Amy, thank you so much for coming back to me, and sorry for the slow reply. I've now opened a case: #CSE_01iu4vykeYDA9JVJ (Billing > Refund Request, Paul Main's projects, Pro). The case has the full picture: how the Preview build costs grew from May to October as our automated coding agents scaled up, the October Build CPU figure, and the three changes we've made (an ignoreCommand, on-demand Previews and Spend Management). I've had a lot of automated replies while trying to get this looked at, so I'd be really grateful if a member of the Billing team could take a look personally. We're a small non-profit social enterprise supporting teachers, and a goodwill review would make a real difference to us. If you're able to flag the case to a colleague, thank you very much. I'm happy to answer any questions. Kind regards, Paul
Amy Egan Please refer to the documentation for more details. There is an Ask AI feature available to help you vercel.com/docs
Juanclases33 5979 Thanks, Amy. I followed your suggestion: I read the relevant documentation and asked the docs' Ask AI about each unresolved point. Its answers did not identify a documented source that settles the distinctions below. I am not treating an AI answer as an official confirmation of unavailability. Could a Vercel team member answer these six numbered questions, or route the runtime/history questions to the relevant product team? The current single-human Owner role/count is already resolved. **1. Direct versus inherited access on Hobby** The Hobby comparison lists RBAC as N/A, and project-level roles are Enterprise-only. Does this mean that separate direct-project and inherited-team membership categories are **not applicable** to a single-Owner Hobby project? If they are applicable, how is that Owner classified, and which supported source defines the counts? Please distinguish effective permissions from stored assignments. **2. Overlap** If those categories apply, can the same Owner belong to both? Is there a supported aggregate source or documented rule for determining the overlap without publishing identities? If overlap is not applicable on Hobby, that explicit answer is sufficient; I do not want to infer zero from an unavailable UI. **3. Historical runtime version** The Node documentation explains automatic minor/patch updates and that build and runtime versions may differ. If an old invocation did not log `process.version`, is there any supported read-only record of the exact runtime minor/patch for an existing deployment, region and past timestamp? If yes, which source/field and retention? I am not asking for a pinned version, a new invocation, or the build-time version. **4. Installed function artifact** Does a customer have a supported read-only source for an immutable digest/manifest of the function artifact actually installed for an existing deployment? List Deployment Files describes source files, not that installed output. If the installed-output identity is not exposed to customers, please confirm that specific limit. **5. Provenance of that artifact** Is there a supported retained record linking that installed output to its source commit, resolved dependencies, build, deployment, environment and timestamp? Deployment metadata and build logs provide some of those facts; is the complete linkage available, and which parts are not covered? No environment-variable values or secrets are requested. **6. Past non-Fluid duration** The legacy guidance confirms the 10-second Hobby default without Fluid. For the original non-Fluid context on 11 October 2026, does a blank project Max Duration field with placeholder 10 establish that default, or can another setting override it? What retained source establishes the configured/applicable value at that time when the project response omits the relevant keys? The Activity Log lists `project-function-max-duration` and `project-functions-fluid-enabled/disabled`; GET /v3/events supports `withPayload=true`. Do these specific payloads include old/new settings, and what retention applies? Our earlier filtered read did not supply a historical value, so repeating it without a new reason would not settle this. **A short answer per number is enough:** applicable/not applicable; exact supported source and field if available; known coverage/retention limit. “Not customer-accessible” is useful. If internal retention cannot be confirmed, please say so rather than equating it with “not retained” or “impossible to reconstruct.” Partial answers are welcome. This remains a general, read-only capability question on Hobby: no account/project identifiers, private logs, attachments, upgrades, paid services, invocations, deployments or configuration changes are requested. Thank you.
