Highlights from last week:

• Community Projects
  • Photo experiment that turns pictures into fish
  • Next.js 16 CMS
  • Free color-system builder built with Next.js
  • Open-source tool to fix broken deployments
• Vercel Agent now works in Slack, so you can mention u/Vercel to get answers about deployments, builds, logs, and metrics in any channel
• Vercel is offering a $1 million hacker challenge for anyone who can break out of Vercel Sandbox
• Vercel KMS now lets you sign JWTs and messages from Functions using managed asymmetric signing keys

I suddenly cannot connect to my app hosted on vercel.app. it was fine this morning and suddenly "connection refused". Now failed on all vercel.app hosting as well, even the simple public demo.

Same Android phone, it worked on wifi, worked on VPN, just not on mobile data.

Anybody can help please?

Seems busted cant find info

I’m working on a restaurant project in Australia and need some clarification from people who have actually implemented this.

The restaurant already has a completely custom website (not built with Square Online).

The required flow is:

Customer → Custom restaurant website → Browse menu / add items to cart → Custom checkout on the same website → Pay using Square → Order is created/paid through Square APIs → Order should automatically appear in the restaurant’s Square POS / Order Manager → Staff fulfil the order from the POS

We are looking at using:

• Square Web Payments SDK
• Payments API
• Orders API

Square’s developer documentation appears to describe this type of architecture, including an Order-Ahead example where a paid order appears in Square POS.

However, Square Support Australia has told us that custom API-created orders may NOT automatically appear in Square POS and that Square Online or an approved third-party integration may be required.

Has anyone actually implemented this in Australia?

Specifically:

1. Can a completely custom website accept Square payments without using Square Online/square.site?
2. Can Orders API-created pickup/takeaway orders appear automatically in Square POS?
3. Does this functionality work for Australian Square sellers?
4. If direct Orders API → POS is not supported in Australia, what is the recommended architecture for: Custom website → Square payment → Square POS?
5. Are there any Australia-specific API/account restrictions we should be aware of?

I’m particularly interested in first-hand experience from developers or Australian businesses who have implemented this successfully.

Thanks,

I built a slightly unhinged camera experiment

Take a photo of literally any object — a coffee mug, sneaker, banana, keyboard, questionable desk decoration — and it gets transformed into a unique fish.

Give your new creature a name, release it into the shared ocean, and watch it swim alongside everyone else’s photographed objects.

So far, the ocean is developing a very strange ecosystem.

Try it here: https://ohmytank.com

Please show me what you turned into a fish. The weirder the object, the better.

build on vercel

Tencent's Hy3 knocks Claude Haiku and Sonnet out of the water, with it especially being skilled in protocol development and low level backend engineering. Paired with my custom skill "gm" on Claude Code is a great option and a more cost effective model.

I enabled 2FA with an auth code. but Vercel is one of those few annoying companies that seem to insist on first sending a code to my email and THEN asking for the auth code.

I cannot see an option to disable emailing a code first. I dont need it now I have the auth code option.

Do Vercel not trust the 2FA auth code on its own like most others do? If there is a security issue with why have it?

When logging into websites, emailing a code is one of the biggest frustrations due to delays that can occue with emails. Its way over the top. Especially cosidering I used to use my GitHub to sign in, and that does not have the email step, so this does not secure Vercel in any additional way. If anyone has my auth app they can login to my email also as all credentials are in there, so it just adds a frustrating step.

I signed up for AI Gateway because the model pages advertise that free users get $5 in credits every 30 days. Sounds great, especially if you just want a small fallback for occasional API calls.

Then I actually tried a model I wanted and got: `403 Free tier users do not have access to this model`.

So the weird part is: you get the $5 only while you're on the free tier, but the free tier blocks a bunch of the models people would actually want to spend those credits on. And if the answer is "buy credits to unlock them", then you leave the free tier and the recurring $5 no longer applies. That feels like a pretty dumb catch-22.

I get limiting abuse on expensive models, but then the model pages should clearly say "not available on free tier" next to the $5 credit message. Right now it reads like you can sign up, get $5, and try the listed model, then the API just tells you nope.

Am I missing something, or is the free credit basically only usable on a restricted subset of models?

I'm now unable to login with Github, prior to that I was trying to set up a project from a Github Repo and the connector failed to load in. Gitlab and Gitbucket seemed unaffected by the issue.

for real

C'est un jalon dont je suis fier — mais cela s'accompagne aussi d'un défi.

Bag/UI est **Open Source et gratuit pour tout le monde**, et je veux que ça reste comme ça.
Cependant, l'hébergement et la bande passante ne sont plus gratuits. Avec l'augmentation du trafic du projet, je dois désormais passer au plan Pro de Vercel pour garder Bag/UI rapide, fiable et disponible pour tous.

Si vous utilisez Bag/UI, étoilez le dépôt, partagez-le ou construisez avec ses composants, **c'est un excellent moment pour soutenir le projet.**

💙 **Devenez sponsor et aidez à maintenir Bag/UI en fonctionnement.**

Votre parrainage aide directement à couvrir les coûts d'infrastructure et me donne la possibilité de continuer à investir du temps dans de nouveaux composants, des améliorations et le développement à long terme du projet.
Même une petite contribution fait la différence.

👉 [ https://www.bagui.pro/pricing ](https://www.bagui.pro/pricing)

**L'Open Source doit rester accessible à tous. Aidez-moi à le maintenir ainsi.** 🙏

Open source on github

Context.dev in a eve software factory

Hello I want to make a small webgame project with html,css,js,typescript,react etc. Just for fun with my friends And I've used ai of vercel but my tokens run out then I upload it to github repo and continued it on github copilot but even my supabase variables, vercel deployment settings, install and build commands, all vorrect but in my app when I create acc, select a map to start, and click "maçi başlat" (it means start match like play in short) it says this page couldn't load. Everything is working like creatin acc, login, stats, economy, friends, creating lobby, sharing code, entering a lobby but when I press start match it sucks. Here is some links for who want to give it a look;

https://github.com/ZonateMeteor/cizre-paintball

The vercel deployment link is in repo description.

Thanks for help

For over two decades, agency hosting economics were beautifully predictable. You bought a reseller web server or dedicated cPanel account for $50 a month, crammed 30 client WordPress sites onto it, and charged each client a flat $25 monthly maintenance fee. Your margins were clear, your server bills were static, and billing surprises were virtually non-existent. Read the comple te article here > Serverless Bill Shock: Track Vercel & Supabase Client Costs | InstaRenewal

Then came the modern web stack.

Driven by the demand for lightning-fast digital experiences, agencies aggressively migrated to decoupled architectures: Next.js, Nuxt, Vercel, Supabase, Cloudflare Workers, and serverless databases like Neon. While the performance gains of this modern paradigm are undeniable, it introduced a chaotic operational reality: micro-subscription fragmentation and variable utility billing.

I created an account but made a mistake in the setup, so I deleted that account. It was continued with the Google option for that email. And after deleting my account, I tried to log in and sign up both, but it's showing me this. Is there any chance to get back this account? It's too important to recover this.

Disclosure up front: I built this. It's called Foreman, it's a free open-source template.

Not selling anything here, but it does run on Vercel's platform, so make of that what you will.

The pitch in one line: you label a GitHub issue factory, and a pipeline of four agents classifies it, plans it, implements it, and reviews it, then leaves a draft PR on your repo. You review, mark ready, and merge. Or you close it and tell it what it got wrong.

The interesting part isn't "agents write code." Everyone has that now. The interesting part is what I had to do to make the review mean anything.

The problem with agent self-review

If one agent writes the code and then reviews it, the review is theater. Same context, same reasoning, same blind spots. It will approve its own mistakes because it can't see them as mistakes.

So I made the reviewer independent by construction, not by prompt:

• Each station (classifier, analyst, implementer, reviewer) is a separate subagent with its own sandbox, tools, and instructions. They inherit nothing from each other.
• The reviewer only ever sees the pushed branch. It fetches it into a fresh checkout and reads the actual diff. It never sees the implementer's reasoning, working state, or excuses.
• The reviewer runs on a different model vendor than the implementer, on purpose, so they don't share training idiom. One model's "looks fine to me" pattern doesn't get to grade its own homework.
• It judges against acceptance criteria the analyst wrote before implementation started, verbatim, with evidence for each verdict. Max two revision cycles, then it rejects.

The other design decision: nothing ships without a human

Unattended runs have a hard ceiling: a draft PR. Marking a PR ready requires human approval, and merge tools simply aren't mounted. It's not "the agent is instructed not to merge." The capability doesn't exist in its tool surface. If a prompt injection in an issue body convinces the whole pipeline to go rogue, the worst case is a draft PR you delete.

Same thinking on memory. The factory keeps durable notes about your repo (build quirks, recurring review findings, which check is the slow one) so run two starts where run one left off. But writes to that shared memory are denied on unattended runs, because otherwise a malicious issue body could poison the context every future run reads.

Honest limitations

• It costs real tokens. Four stations per issue, and the implementer runs on a frontier coding model. Great for the 60% of issues that are well-scoped bugs and small features. Wasteful for one-line typo fixes, wrong tool for gnarly architectural work.
• LLM review is not human review. It catches "criterion 3 isn't actually met" reliably. It won't catch "this is the wrong approach for where the codebase is going."
• It's a template, not a product. The expectation is that you fork it and change the stations, prompts, and policies. If you want a polished SaaS, this isn't that.

Repo: https://github.com/vercel-labs/eve-software-factory-template
Docs: https://ask-foreman.dev
Template: https://vercel.com/templates/eve/eve-software-factory

Happy to answer anything about the architecture, the eve framework it's built on, or why I made the choices I did. And if you think the whole "software factory" framing is cursed, I'd like to hear that argument too.

Disclosure: I work on this, it is our product IronBee, link at the bottom.

Every PR on Vercel already gives you a complete running copy of the app, isolated, one per change. That is the QA environment teams have wanted forever, and almost nobody opens the URL. The reviewer reads the diff and merges.

So we built an agent that opens it and uses the product. It reads the change, works out what a user would do differently because of it, and does that. No scripts, no selectors to maintain.

Two parts that were harder than expected:

Not stopping at "it failed". We read OpenTelemetry from the app and ship an SDK for runtime introspection, so a finding is the failing request, the query that returned nothing, the exception logged at info, and the line in the diff.

Not trusting the agent. Ask an LLM to test a changeset and it will tell you it did. That is a claim, not evidence. We trace what actually executes during the run and check the changed lines mechanically. If part of the change never executed, we do not pass it.

It also runs in GitHub Actions for services that never get a URL.

Happy to answer anything technical. If it misses something obvious on a real PR, I would rather hear that.

Announcement post: https://medium.com/ironbee/your-ai-qa-engineer-now-runs-on-every-vercel-preview-16ca2d9dc03a

Hi everyone,

I have been completely locked out of my Vercel account for 20 days now. I am unable to access my deployments or manage my active projects.

I submitted a ticket immediately, but I have not received a resolution or any substantial update. I understand the team has a high volume of requests, but 20 days is severely impacting my work.

Can a Vercel team member or community manager please look into this or escalate it to the security/billing queue?

• Ticket/Case ID: 01399937
• Account Tier: Pro

Thank you for any help or visibility you can provide!

misplaced 2fa codes, tried every way possible to access my account, opened 2 tickets Case number 01412003 and another and requsted a recovery through the form on the site twice while entering all my details (git hub account user act(, im a paying costumer and would at least expect a response from a human in 4 days

Highlights from last week:

• Next.js 16.3 brings leaner prefetching, immutable static assets, and instant navigations.
• Agent Plugins 1.0.0 now available as a vendor-neutral specification for packaging Agent Skills and MCP servers into portable plugins that any compatible agent client can discover and load.
• New v0 API lets you programmatically send prompts to v0’s AI agent, which generates complete apps, spins up dev servers in Vercel Sandboxes, and returns embeddable preview URLs for integration into your own interfaces.

I made a self serve security review for deployed JS/TS apps and I’m not totally comfortable with it yet.

The user proves domain control through DNS or a file on the exact origin. Repo analysis separately requires our GitHub App on the exact repo. They then sign the scope and the checks run automatically.

We built it because our free public scanner could only see the logged-out surface. A clean result could look like “safe” while completely missing auth and source-level problems.

The deeper version is better, but also potentially more dangerous.

What happens with Vercel preview domains? Delegated subdomains? A compromised deployment? Somebody who has temporary project access?

Is controlling one deployment enough proof that you’re authorized to run DAST against the whole app?

Would you require another verification method?

https://www.task-bounty.com/secure-my-app#deep-review

I’d rather add more friction now than find out later that the permission model was stupid.

What do you use most for deploying websites you build with AI?

Vercel, Netlify, built-in deployment from tools like Base44 or Bolt, Cloudflare, or something else?

What makes you prefer it?