Vercel got hacked today.
A few weeks ago, it was Axios. Last month, somebody else.
Heads up: this isn't the usual Notion + AI email.
This matters way more than another template would right now.
If you run any kind of business with a website, even a small one, this affects you.
By no means should you panic or feel overly concerned.
Just spend five or ten minutes, and you'll be much safer going forward.
What just happened:
Today, a company called Vercel said someone got into their internal systems.
A few weeks back, the same kind of thing happened to Axios.
You don't need to know what either of those companies do.
The point is that these are professional, well funded tech
companies, and they got hit anyway.
This isn't a "you're doing something wrong" problem.
It's a "this is the world we live in" problem.
Even the big players get hacked.
The real question is whether you're set up to bounce back when it happens.
And by the way, Vercel is one of the largest developer hosting platforms out there.
(6million weekly downloads)
If they had NPM access keys, we don't know how big the attack surface is.
One malicious push = global supply chain attack
What this has to do with your business:
If your website was built on custom HTML (code) & connected to Vercel as a hosting platform there are a few things you might need to check on.
Do you have any environment variables or API keys connected to your website?
This could involve:
sign up forms
newsletters
buy buttons
payment links
blog posts
Each of those connections uses something called a "key."
Basically a password your website uses to talk to the other tool.
If one of those keys leaks in a hack, the wrong person could read your data, charge your customers, or send emails as you.
The good news: you can fix this way quicker than you think.
What to do this week: (for everyone)
If somebody else built or runs your website, message them today.
have them rotate all of your API keys and environment variables in Vercel.
(Applies for those using Vercel)Turn on two-factor authentication (2FA) on every account that touches your business. (everyone)
If you get a "your account may be affected" email this week, don't click the link.
(likely spam) (everyone)
That's it. None of this is super technical. Just some basic website hygiene.
But this isn't stuff to joke around about either, especially with your business.
Before You Go
If you don't already have a single place to track your sites.
My Website Manager tracks every landing page, domain, & connected tool in one spot.
Grab it free below:
