The post Vercel April 2026 Incident: Non-Sensitive Environment Variables Need Investigation Too appeared first on GitGuardian Blog - Take Control of Your Secrets Security.

An attacker compromised the tool's Google Workspace OAuth app, hijacked a Vercel employee's account, then accessed environment variables that weren't marked "sensitive." Vercel is now asking customers to rotate those secrets, even though they were classified as non-sensitive.

Vercel contacted the limited subset of customers whose credentials were confirmed compromised. But the broader lesson applies to any organization: a third-party OAuth compromise can cascade into internal systems fast. Vercel called the attacker "highly sophisticated" based on their speed and detailed knowledge of Vercel's systems.

Assume any related secret is at risk until you've investigated it. Identify every exposed credential, check where it's used, and confirm whether it's active or already abused. Then revoke or rotate it, redeploy, and verify dependent services.

Vercel's guidance is direct: use the "sensitive" flag for environment variables that contain API keys, tokens, database credentials, or signing keys. Sensitive variables are stored in a way that prevents them from being read.

If you're a Vercel customer responding to this incident, start by pulling your environment variables locally and scanning them for exposed secrets.

Pull your environment variables for each project:

Then scan the file with GitGuardian:

GitGuardian will identify which variables contain valid secrets, such as API keys, tokens, or database credentials, signing keys. This gives you a prioritized list of what to rotate first. You can also scan across multiple projects by pulling each environment file and scanning the directory:

Once you've identified exposed secrets, rotate them in your upstream services (like AWS, Stripe, or database providers) before updating the values in Vercel.

Vercel published the following guidance for customers:

*** This is a Security Bloggers Network syndicated blog from GitGuardian Blog - Take Control of Your Secrets Security authored by Guillaume Valadon. Read the original post at: https://blog.gitguardian.com/vercel-april-2026-incident-non-sensitive-environment-variables-need-investigation-too/