Hello, I'm an AI assistant from Vercel. If we find something I can't solve, I'll help create a support case for you.

• Vercel

  v0

  Thank you. Can you also let me know which account are you inquiring about?

  

  Hobby

  What's the problem?

Hello Vercel Support,

I am investigating what appears to be unauthorized usage of an Anthropic API key that was stored in my Vercel project.

Relevant details: I created a new Anthropic API key and added it only to the Production environment variables of a single Vercel project (Tabum). I am the only member of the Vercel account/team. The key was never committed to Git, shared, or added to any other project, service, or environment. The application code uses only the model claude-haiku-4-5-20251001. After the key was added to Vercel, Anthropic usage logs began showing requests using multiple models that my application does not call, including Sonnet, Opus, Fable, and large streaming requests. My codebase contains no references to those models and no code paths that would select them. I have since rotated credentials, enabled a passkey, logged out sessions, and reviewed project access.

Could you please review any available audit logs and help determine: Whether there were any unexpected logins, sessions, or account access events. Whether the environment variable may have been accessed, revealed, or used outside of normal deployment execution. Whether there is any project activity, deployment activity, or platform-level information that could help identify how the key may have been exposed or used.

I can provide timestamps, request IDs, screenshots, and additional details if needed.

Thank you for your assistance.

hello

?

I understand how concerning it is to discover unexpected usage on your API credentials. To help you investigate, I have reviewed the available platform audit logs for your account and the tabum project.

Our audit records show no unexpected logins, sessions, or unauthorized account access. Every single action on your account and project was initiated by your primary user identity (jayhilwig@gmail.com).

Here are the specific audit log events regarding your ANTHROPIC_API_KEY for today (June 10, 2026):

• Environment Variable Viewed: At 17:23:48 UTC, the environment variable was decrypted and viewed in the Vercel Dashboard by your user account.
• Environment Variable Deleted: At 17:46:29 UTC, the variable was deleted from the project.
• Environment Variable Re-added: At 17:59:46 UTC, the variable was added back to the project for the Production and Preview environments.
• Production Deployment: At 17:59:56 UTC (10 seconds later), a new production deployment was triggered, which successfully built and injected the new environment variable value.

There are no other read, edit, or view events for this environment variable recorded by any other user or system process.

Given that there are no signs of platform-level compromise or dashboard access by third parties, there are two primary vectors through which these unexpected model calls might be occurring:

• Vector A: Dynamic Model Routing via an Unauthenticated API Route: If your application has a public API endpoint (such as /api/chat or /api/generate) that routes requests to Anthropic, check if your code dynamically reads the model parameter from the incoming request body (e.g., model = req.body.model || 'claude-haiku-4-5-20251001'). If the endpoint has no authentication or rate limiting, an attacker could scan and find your API endpoint and send custom payloads specifying expensive models like Sonnet or Opus. In this scenario, your API key never leaves Vercel, but attackers abuse your serverless function to make the calls.
• Vector B: Client-side Exposure or Build Bundling: Ensure that the API key is never referenced or imported in a client-side component or file that gets compiled into the browser bundle. Even without the NEXT_PUBLIC_ prefix, statically referencing server-side process variables in client-side files can sometimes cause bundlers to inline the value into the public JavaScript files.
• Vector C: Repository and Local History: Even if the key is not currently in your active codebase, check if it was ever accidentally committed in a previous Git commit or alternative branch. Automated crawlers constantly scan public and private repositories for credentials. Also, verify that any local .env files were fully ignored and never committed to your repository's history.

To help you investigate this further at the platform and runtime level, I have prepared a support case for you. The case form is visible below this message. You can submit it to have our engineering and security teams review your serverless function execution logs and investigate the request patterns.

I pay for v0 but not Vercel so this is the response from the AI bot: Vercel Case

The more detail you can provide, the better we can help you.

jayhilwig_team

Hobby

Problem Area

Select a topic...Account SettingsSecure Compute & ConnectSSO/SAMLAI GatewayQueuesVercel AgentVercel MCPWorkflowsInvoice EnquiryNew Pricing (Bug/Issue)New Pricing (Feedback)Pricing EnquiryUpgrade/DowngradePayment FailureRefund RequestUsage EnquiryMarketplace InvoiceBlobEdge NetworkEdge CachingImage OptimizationLoad TestingMicrofrontendsRoutingBuildsConformanceEnvironmentsFrameworksGit ProvidersMonoreposRolling ReleasesVercel CLICRON JobsMiddlewareVercel FunctionsVercel SandboxDNS ConfigurationRegistrationRenewalsSSL CertificatesTransfersThird-Party ProxyingDeployment ProtectionEdit ModeMarketplaceNotificationsToolbarVercel DashboardEdge ConfigFlagsO11YLogsSpeed InsightsWeb AnalyticsFirewallFirewall Agent

Severity LevelLearn More

Visit our Community for further help or create a paid account for dedicated Accounts → Account Settings support.

I wrote to security@vercel.com per the docs at: https://v0.app/docs/security

That state: *If you discover a security vulnerability in v0, please report it to our security team at security@vercel.com. We take all security reports seriously and will respond promptly. * Note I have been a paying v0 customer on and off for over 2 years. I was disappointed to receive the "unmonitored email" AI response below. I don't understand the request for me to be a Premium member to get actual human support when I'm an active v0 user. Why are they distinguished? I don't actually use strict Vercel offerings at all but I have to have an account outside of v0?

__________________________________

Hi there,

Thanks for reaching out. This inbox does not provide security support and is not actively monitored for help requests. To make sure your message reaches the right team, please use one of the channels below.

For help with your Vercel account, including security-related issues: please go to https://vercel.com/help . This is the fastest path to get help

vercel.com

Help

Discover solutions through our documentation, guides, and community.

◦ This includes account access problems, billing, MFA, audit logs, suspicious activity on your account, suspected account takeover or compromise, abuse on a project you own, or any other product issue. ◦ Vercel's Customer Support team monitors this channel and will route your request to the right specialist (including our Security, Trust & Safety, or Abuse teams) if escalation is needed. ◦ Reaching out via vercel.com/help, even for security-flavored concerns, will get you a response far faster than emailing security@.

For reporting a security vulnerability in Next.js or the Vercel platform, please submit through our HackerOne program: https://hackerone.com/vercel-open-source

For compliance, security documentation, and trust resources such as SOC 2, ISO, pen test summaries, sub-processors, and security questionnaires, see our Trust Center at: https://security.vercel.com/

Law enforcement requests, subpoenas, court orders, preservation letters, and civil discovery: please email legalrequests@vercel.com

Privacy, DSAR, or GDPR requests: please email privacy@vercel.com

DMCA and copyright takedown notices: https://vercel.com/abuse

Support requests sent to this inbox are not monitored and will not be answered. Use the channels above to get help.

Best, ▲ Vercel Security

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Hi Jay,

At this point I’d try to prove or disprove one narrow thing: did the Anthropic requests actually originate from your deployed Vercel runtime?

I’d add temporary server-side logging around every Anthropic call, but only log safe metadata:

1
console.log("anthropic_call_start", {
2
  route: "/api/your-route",
3
  model: MODEL,
4
  maxTokens,
5
  stream,
6
  vercelEnv: process.env.VERCEL_ENV,
7
  deployment: process.env.VERCEL_URL,
8
  commit: process.env.VERCEL_GIT_COMMIT_SHA,
9
  timestamp: new Date().toISOString(),
10
})
11

Then, after the Anthropic response, log the provider request ID if your client exposes it. Anthropic responses include a request-id header / request ID, which is the best thing to compare with Anthropic support or usage logs.

Do not log the API key, prompt, user content, request body, headers, cookies, or full response.

I’d also search the whole repo for any other path that could call Anthropic indirectly:

1
grep -R --line-number "anthropic\|claude\|ANTHROPIC_API_KEY\|model" .
2

Things I’d specifically check:

1
- API routes that accept a model from req.body
2
- cron jobs / scheduled tasks
3
- preview deployments using the same Production/Preview key
4
- shared env vars linked to more than one project
5
- AI SDK provider config or fallback model logic
6
- old deployed versions still reachable on preview/deployment URLs
7

Then compare the Anthropic usage timestamps with Vercel Runtime Logs for the same route and time window:

https://vercel.com/docs/logs/runtime

vercel.com

Runtime Logs

Learn how to search, inspect, and share your runtime logs with the Logs tab.

If Anthropic shows usage at a timestamp but Vercel has no matching function invocation, that is useful evidence that the request may not have gone through your deployed app. If Vercel does show a matching invocation, the logged model/request ID should tell you which route/deployment produced it.

I would also be cautious about interpreting the “Environment Variable Viewed” audit event without Vercel clarifying exactly what it means. For a sensitive env var, I’d expect the value itself not to be readable after creation, but the audit event wording alone may not tell you whether the raw secret was displayed or whether the env var record/page was accessed.

Thanks Ryu for the useful information and feedback.

I won't get too detailed on the different ways I've approached the issue but whether my LLM provider was OpenAI or Antrhopic, it seems to be a bot/credential harvester gaining access through Vercel. Yes I've changed my password, 2FA, rotated to sensitive env vars etc.

Attaching a log snippet where you can see they probe for a lower model and once that is validated start prompts around transcribing video.

In the interim, I set up a proxy via Railway so none of my API keys are stored in Vercel.

I wrote to Vercel security on June 14, 2026 and I'd like to reiterate what the official Vercel logs state re: security, see https://v0.app/docs/security#security-reporting

v0.app

Security | v0 Docs

Learn about v0's security practices, threat modeling, and enterprise security features.

"If you discover a security vulnerability in v0, please report it to our security team at security@vercel.com. We take all security reports seriously and will respond promptly."

Vercel has not responded to my ticket/email and it's very disappointing their security team is not more engaged given the recent security "incidents".

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

And to be clear I did as the bot suggested and "report abuse on Vercel" (?) even though that's not related to my security concern. When you follow their prescribed route, you're presented with the attached image.

Writing to abusereports@vercel.com produced the following auto generated response, June 14, 2026.

Doing some auditing, this may have been an exposed route in my code that should have been removed when moving from dev to prod. I created an API key, openAI, in Vercel settings and have noticed no activity.

Hi jayhilwig,

That explanation makes sense. If the exposed route was callable in production, I’d treat the old provider keys as compromised even if the usage has stopped now.

A clean way to close the loop would be:

1. Rotate/revoke the old OpenAI and Anthropic keys.

2. Update the Vercel environment variables with the new keys and redeploy, since env var changes only apply to new deployments.

3. Remove the route completely if it was dev-only, or put server-side auth/rate limiting in front of it if it still needs to exist.

4. Check Vercel Function logs around the provider usage timestamps for that route: path, method, user agent, IP/region, and status code.

The fact that your newly created OpenAI key has no activity is a good sign that the old exposed route/key path was likely involved. I’d still rotate the Anthropic key too if it was reachable through the same code path.

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Thanks Ryu,

I ended up using Railway as a proxy and destroyed all compromised keys and added new ones in Railway, not v0.

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Hi jayhilwig,

That sounds like a reasonable containment step. I’d still make sure the cleanup also happened on the Vercel/v0 side, not only in Railway.

The main things I’d double-check:

1. The old OpenAI and Anthropic keys are revoked at the provider level.

2. Any old Vercel environment variables containing those keys are deleted or replaced.

3. The Vercel project was redeployed after removing/changing env vars.

4. The exposed route is removed or locked down, even if the proxy now lives somewhere else.

5. No provider key was committed into the repo or copied into client-side code.

Moving the proxy to Railway can reduce the blast radius if that is where you want the backend boundary to live, but the important part is that browser/client requests should never be able to directly trigger arbitrary provider calls with your server-side key.

If usage stays flat on the newly created keys after the old route and old keys are gone, that’s a good sign the incident was contained.