I just received a concerning email from security@vercel.com suggesting I have a possibly leaked secret for RazorPay in one of my v0 prompts. I don't believe my team have ever used anything remotely like RazorPay so this email concerns me. I have searched my v0 chats and vercel dashboard and cannot find any references to RazorPay.
Is this legitimate? If so, how can I track down the prompt?
Hi dfranco,
I’d treat the warning as real until you can disprove it, but I would not click links from the email first. Open Vercel/v0 directly from your browser and check from there.
A few safe checks:
1. Confirm the sender domain is exactly vercel.com2. Check whether the email includes a workspace, project, chat, or secret fingerprint3. Search v0 chats for: RazorPay Razorpay RAZORPAY key_secret rzp_4. Search connected GitHub repos and environment variables for the same terms
Even if your team never intentionally used Razorpay, it could still be from pasted example code, generated mock payment code, a dependency/config snippet, or a copied prompt that contained a Razorpay-looking pattern.
If the email includes a secret fingerprint or partial match, compare only that partial value locally. Do not post the full secret, email links, headers, or any token publicly.
If you find any actual Razorpay-looking value, rotate/revoke it even if you think it was unused. If you cannot find anything, the most useful thing to share here would be the email subject, timestamp, and any non-sensitive identifier like workspace/project/chat ID with links and secret values removed.