Audit Tool for Vercel Exposure of Environment Variables
Article URL: https://github.com/garyhtou/Vercel-Env-Var-Exposure-Triager Comments URL: https://news.ycombinator.com/item?id=47828203 Points: 1 # Comments: 1
Article URL: https://github.com/garyhtou/Vercel-Env-Var-Exposure-Triager
Comments URL: https://news.ycombinator.com/item?id=47828203
Audit tool for the Vercel April 2026 security incident . Produces a CSV worklist of every non- sensitive environment variable in a Vercel team so they can be rotated.
It does not read secret values. The Vercel API is only called without the decrypt flag, and value / decryptedValue are stripped from every response on ingress as defense in depth.
I work at Hack Club , and our Vercel team has 400+ projects and 750+ environment variables. Manually triaging a leak at that scale — figuring out which variables are actually secrets, which were already public, who owns what, and what can safely be skipped — would have eaten a week.
So I built this tool with the help of Claude Code. It turns the incident-response question from "where do I even start?" into a sortable, owner-attributed CSV that a team can divide and conquer in an afternoon. Hopefully it helps you too.
That's it. The tool will prompt for your Vercel token (input hidden), auto-detect your team, and write rotation-report.csv in the current directory. Open the CSV in a spreadsheet and start delegating rotations.
Need a token? Create one at vercel.com/account/tokens — pick your team as the scope and a short expiration (1 day is fine). Revoke it when you're done.