Vercel wants to eliminate long-lived API keys from its ecosystem, and it is giving Marketplace vendors until January 2027 to comply or risk being delisted, a push that lands as a run of credential-stealing supply chain attacks — including a recent npm worm that scraped tokens straight out of CI pipelines — keeps proving how much damage a single leaked secret can do. Vercel’s own GitHub Actions deployment workflow still relies on the kind of persistent credential the company now wants gone. Developers have already pointed out a complication, though: Vercel’s own GitHub Actions deployment...

Source: The New Stack