If your marketing site, SaaS, or Next.js app already runs on Vercel, the April 22, 2026 security news is not about switching hosts overnight — it is about tightening identity, integrations, and secrets in one focused sitting. The fastest teams treat this like a short incident: assume secrets may have been read, revoke unnecessary tokens, and rotate what matters most before you go back to the roadmap.
Phase 1 (about 15 minutes) — lockdown Vercel and identity providers. Revoke Vercel access tokens you do not need (vercel.com/account/tokens), keep only the active CLI and current session, and be aggressive on anything labelled “Never expires” that is older than 30 days. Open your team audit log (vercel.com/[team]/~/settings/audit-log) for the last seven days: unexpected deploys, environment reads, or unknown IPs are worth escalating internally. In Integrations (vercel.com/[team]/~/integrations), remove tools you are not actively using — especially AI code review, “vibe” deploy assistants, and anything that can act on your behalf. Because most developers log in to Vercel with GitHub, finish Phase 1 by reviewing GitHub authorized OAuth applications and personal access tokens (github.com/settings/applications, github.com/settings/tokens), turn on TOTP 2FA (not SMS), and refresh recovery codes. Finally, on Google (myaccount.google.com/permissions), review third-party access and scan Gmail for rogue forwarding rules.
Phase 2 (about 15 minutes) — rotate secrets for your one or two most critical projects. You cannot re-key the entire company tonight; you can still protect Stripe, databases, LLM API keys, and auth on your revenue apps. Open each key in the upstream provider, update Environment Variables in the Vercel project, mark every value as Sensitive, and trigger a redeploy so running builds do not keep old material. The checklist below is written so you can literally tick boxes while you go.
Key takeaways
- One integration with deploy + env read scope is enough to exfiltrate non-Sensitive Vercel environment variables—revoke first, re-authorize later with least privilege.
- Audit logs and GitHub PAT hygiene matter as much as Vercel itself when GitHub OAuth is the login path to both Git and hosting.
- Rotation without redeploy leaves old keys in the currently running serverless and edge bundles—redeploy right after you save new env values.
