Vercel confirmed that attackers gained access by exploiting a compromised Context.ai Google Workspace OAuth app, then pulled non-sensitive environment variables and escalated privileges. The hacker claims to be selling API keys, source code, deployment data and employee records; Vercel has tightened its dashboard controls, urged secret rotation and marked sensitive variables for encryption.

• Breach originated from a Vercel employee's Google Workspace being compromised via a third-party app (Context.ai), not a direct Vercel exploit.
• Only non-sensitive, unencrypted environment variables were exposed because they weren't marked "sensitive"; core products like Next.js and Turbopack were unaffected.
• A hacker claiming to be ShinyHunters is selling access keys, source code, database dumps, and employee data (580 records with names/emails), though the real ShinyHunters have denied involvement and BleepingComputer hasn't verified the leak.
• Vercel responded by adding a dashboard toggle to mark and encrypt sensitive variables and is urging customers to rotate secrets immediately.