One Checkbox Away: The Vercel Breach and the Case for Zero Standing Privileges
There’s never a good time to disclose a breach, but days before your IPO has to rank near the bottom of the list. That was the backdrop to the Vercel breach. On Sunday the 19th, the company confirmed that attackers had walked into parts of its internal environment and walked back out with customer API keys. Early reporting focused on the flashy parts: an attacker claiming ties to ShinyHunters, a $2 million BreachForums demand, crypto teams rotating credentials with the IPO roadshow in full swing.