> Portland has always been a pioneer in urban design, balancing its independent spirit with a deep commitment to sustainable, forward-thinking living.
People should research the racist history of American cities before publishing broad, vapid, and likely LLM-generated statements like this.
If you're going to say a place has "always been a pioneer in urban design", you should take the time to acknowledge that Portland's early urban-design efforts were deeply racist and explicitly segregated.
> What bites people: rotating a vercel env variable doesn't invalidate old deployments, because previous deploys keep running with the old credential until you redeploy or delete them. So if you rotated your keys after the bulletin but didn't redeploy everything, then the compromised value is still live.
That statement in the report really confuses me; feels illogical and LLM generated.
An old deployment using an older env var doesn't do anything to control whether or not the credential is still valid. This is a footgun which affects availability, not confidentiality like implied.
Another section in the report is confusing, "Environment variable enumeration (Stage 4)". The described mechanics of env var access are bizarre to me -
> Pay particular attention to any environment variable access originating from user accounts rather than service accounts, or from accounts that do not normally interact with the projects being accessed.
Are people really reading credentials out of vercel env vars for use in other systems?
It seems you're correct - the post has been modified.
> This entry was updated on April 21 to correct the incident timeline and scope characterization based on post-publication reporting from Context.ai's security bulletin.
> Key corrections: the initial compromise occurred in February 2026 (not June 2024), the initial access vector was Lumma Stealer malware (not an unknown mechanism), the dwell time was approximately two months (not 22 months),
The service wouldn't have access to the refresh token? How does authentication with the client-secret-holding intermediary work?
It's easy to see how this would work with sufficiently sophisticated clients in some use-cases, say via a vault plugin, but posing this as a universal necessity feels like a big departure from typical oauth flows, and the added complexity could be harmful depending on what home-grown solutions are used to implement it.
There are some composers who use a workflow like this - Suno is a scratchpad which can be used to quickly trial ideas, clarify concepts with collaborators, etc. don't think it's common, either among composers, or Suno users at large
People should research the racist history of American cities before publishing broad, vapid, and likely LLM-generated statements like this.
If you're going to say a place has "always been a pioneer in urban design", you should take the time to acknowledge that Portland's early urban-design efforts were deeply racist and explicitly segregated.
https://www.portland.gov/bps/planning/adap/history-racist-pl...
https://habitatportlandregion.org/the-early-history-of-portl...
reply