Vercel Partners with Truffle Security to Expand Token Scanning to More Public Sources

Vercel is strengthening its automated detection and revocation of leaked tokens, expanding scanning to more public sources.

Partnership Expands Scanning Scope

Vercel has partnered with Truffle Security to expand automated detection and revocation of publicly exposed Vercel tokens. Truffle Security reports tokens exposed in public sources such as GitHub, GitLab, Docker, npm, PyPI, Hugging Face, Android APKs, and Firefox extensions, and Vercel has already revoked hundreds of tokens reported by Truffle Security.

Revoking exposed credentials helps prevent unauthorized access to projects and avoids unexpected charges from unauthorized use of services like Vercel Sandbox and Vercel AI Gateway. If your token is revoked, you'll receive an email from Vercel explaining the reason for the revocation.

Truffle Security is a company focused on software supply chain security and secret detection. Its core capability lies in continuously monitoring public code repositories, package managers, container images, and AI model repositories to identify API keys, access tokens, and credentials that have been accidentally committed. Such "secret scanning" services typically establish a reporting mechanism with platform providers: when a token leak for a given platform is detected, the security company feeds the information back to the corresponding platform, which verifies and performs the revocation. The value of this partnership model lies in expanding detection coverage—platforms' own scanners often only see a limited set of public sources, whereas specialized security companies have broader crawling networks and pattern libraries.

Independent Scanner Monitors Common Crawl

In addition to its partnership with Truffle Security, Vercel also runs an independent scanner. This scanner checks the monthly newly released Common Crawl public web dataset and automatically revokes any exposed Vercel tokens found within it. This means that even if a token is leaked on a web page not covered by Truffle Security, Vercel can still detect and address it promptly through the Common Crawl dataset.

Common Crawl is a nonprofit project that regularly crawls and archives public web pages across the internet, forming a large-scale, publicly accessible web dataset that is often used for training language models and conducting web research. Because this dataset is released monthly and covers an extremely wide range, any token accidentally published on a web page may be included. Vercel's independent scanner leverages this characteristic by performing pattern matching on the content of each monthly new dataset to find strings matching the Vercel token format. Compared to monitoring only code hosting platforms, this approach can cover leaks in non-code contexts such as forum posts, blogs, and documentation sites, filling blind spots in traditional secret scanning.

Impact on Developers

For developers using Vercel, this expansion means more comprehensive token security protection. Previously, leaked tokens could persist undetected for extended periods in less common public sources; now scanning covers major code hosting platforms, package managers, AI model libraries, mobile apps, and browser extensions, as well as broadly crawled web data.

Developers should regularly review their token usage and follow the principle of least privilege when setting token scopes. Vercel provides access token documentation detailing how to create tokens, set scopes, and manage tokens.

The principle of least privilege is a core security guideline for credential management: tokens should be granted only the permissions necessary to accomplish a specific task, rather than defaulting to all account permissions. In Vercel, this means creating access tokens with restricted scopes based on their purpose—for example, only for deployments, only for reading project information, or only for calling specific services—rather than using tokens with full account permissions. This way, even if a token is leaked, the impact an attacker can cause is limited to a minimal scope, and it's also easier to quickly identify affected integrations when revoking.

Security Practice Recommendations

Although Vercel's automated scanning provides an extra layer of protection, developers still need to actively manage token security. Avoid hardcoding tokens in code, use environment variables or secret management services to store tokens, and rotate tokens regularly. If you receive a token revocation notice, immediately check the relevant projects for anomalous activity and update the affected tokens.

Token rotation refers to the practice of periodically replacing access tokens and discarding old ones, with the goal of shortening the time window during which leaked credentials can be exploited. Once a token hardcoded in code is exposed along with a repository or output in logs, it's very difficult to completely remove, so a more robust approach is to inject tokens through environment variables or dedicated secret management services, keeping credentials separate from code. Developers should also maintain a token inventory recording each token's purpose, scope, and creation time, so that when a revocation notice arrives, they can quickly assess the impact and complete replacement.