The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables
Summary
Trend Micro analyzes the Vercel OAuth supply chain breach, showing how a compromised third-party OAuth app enabled access to internal systems and exposed customer environment variables, including non-sensitive vars. The report highlights the risks of environment-variable secrets, the long dwell time (~22 months), detection-to-disclosure latency, and advocates architectural changes such as dedicated secret management, OIDC integration, and stronger OAuth governance to shrink blast radius.