Vercel April 2026: what security researchers mean by an OAuth “supply chain” hit | TechTrio Blog