#security

Frantisek Following up: the Vercel Support Agent reports that pre-ingestion/storage redaction of specific Runtime Logs query parameters is unsupported across all plans. The Agent offered a support case, but the form directs Hobby users back to Community for Observability → Logs support. Could a Vercel staff member confirm the redaction limitation and clarify whether Hobby’s one-hour retention means query availability or deletion of underlying request metadata, particularly given the documented availability of older logs after upgrading? My reproduction used fake values only. Deployed OAuth remains disab

Solvion Holdings Not staff, so I can't speak to Vercel's storage. But with PKCE, a logged code and state are low value on their own, and you can make that hold in your app: The code can't be redeemed alone. Spotify's PKCE token request needs the code_verifier your app generated (that interception case is why RFC 7636 exists). Keep the verifier out of the URL: store it in an httpOnly, Secure, SameSite=Lax cookie, delete it after the exchange, and never log cookies. It's single-use and short-lived. RFC 6749 §4.1.2 says a code must expire shortly (10 min max recommended) and must not be used twice. Exchange it in

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Cristovão A. da S. Neto We have already used vercel.com/abuse many times, and that is exactly why we are posting here. We ask that a member of the Vercel staff review the cases concerning berzerkclub[.]com[.]br and berzerkclub[.]com directly, or escalate them internally to Trust & Safety. Both domains serve the same deployment. Reports already filed through the official channel for this same deployment: Sep 28, 2026: phishing report for berzerkclub[.]com[.]br, case 01586466 Oct 2, 2026: phishing and brand impersonation report for berzerkclub[.]com[.]br, case 01597477 Oct 8, 2026: DMCA notice for berzerkclub[.]com[.]b

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Jen 2568 I submitted a report on 9/28, case number 01586042

Amy Egan Thanks for sharing the case number. I'm checking with the team about it now

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

system Hi there! I'm just a bot here to share some info that might help you before a human arrives. If your account is eligible, you can use our new self-service recovery flow: Go to vercel.com/login Choose to sign in using the email + one-time password (OTP) option. Select Use another sign-in method Verify your identity using the GitHub, GitLab, or Bitbucket account previously linked to your Vercel account Follow the remaining prompts to complete the recovery process If you've ever set up a passkey, possibly on another device, you can use that to get back into your account and update 2FA settings yo

Amy Egan Hey there! Thanks for sharing the case number and for NOT posting your email. I found your case and confirmed it's assigned to the right team. It looks like the case was opened just a few hours ago, so escalation doesn't seem to be necessary here. Someone from the support team will reply soon

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Hali New DDOS request has been sended. 1m requests sent successfully with no deny and my project get pause

Amy Egan Were the visits from verified bots? Can we see the graph?

Anshuman Bhardwaj Hi there, I see that there's an ongoing support thread about this and our Support team experts are sharing solutions there. To avoid miscommunication or duplicates I'll defer to them.

Mikelabs They closed my ticket and did not resolve the issue, then issued me a refund. It would be nice if someone from the Vercel team could actually address this.

Mikelabs This is still totally unresolved