Got an email that Vercel revoked your token? It was found somewhere public
Ship ItChecked against the official source
Source checked 7 Nov 2026 · Published 8 Nov 2026 · Last reviewed 8 Nov 2026 · By Ctrl+Z Therapy (how we test)
The short answer
Since November 4, 2026, Vercel works with Truffle Security to expand automated detection and revocation of publicly exposed Vercel tokens. Truffle Security reports tokens exposed in public sources including GitHub, GitLab, Docker, npm, PyPI, Hugging Face, Android APKs, and Firefox Add-ons, and a Vercel scanner checks each monthly Common Crawl dataset of public web pages. If your token is revoked, you'll receive an email from Vercel explaining why.
What to do
- Remove the old token from wherever it was published, and from your code.
- Create a new token and choose its scope. A project-scoped token denies any request to another project.
- Choose an expiration, copy the value once, and store it in an environment variable or secret store.
Good to know
- Vercel says revoking exposed credentials helps prevent unauthorized access to your projects and unexpected costs from services such as Vercel Sandbox and AI Gateway.
- A token's value appears only once, at creation.
Source
Checked on 7 Nov 2026. Prices, limits and settings change, so check the source before you rely on them.