lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Vercel

Vercelcloud5 credentials

Credentials5 documented
01

API Token

vercel / api-token

Vercel API and CLI automation use account tokens. Vercel documentation includes token management and CLI commands that operate with tokens for deployments, teams, projects, and environment variables.

user definedsecrettoken

Looks like

example
example

Vercel API token prefix used by Vercel tokens

vercel_abcdefghijklmnopqrstuvwxyzABCDEF0123456789

Location

http header
Authorization

Bearer token used for Vercel API requests

environment
VERCEL_TOKEN
config file
~/.vercel/auth.json, .vercel/project.json, vercel.json, vercel.jsonc

Vercel CLI config, CI pipeline config, .env files, and deployment manifests; Removed generic/common scanner surface path(s) from product template: .env

secret store

GitHub Actions secrets, CI/CD variables, cloud secret managers, and password managers

source code

deployment scripts, tests, and accidentally committed CLI configs

logs

CI logs, CLI traces, and API client debug output

Notes

Token blast radius depends on account/team permissions and scopes selected at token creation.

02

Project Environment Variable Secret

vercel / project-environment-secret

Vercel projects store environment variables and secrets used by builds, serverless functions, and deployments. Vercel CLI env commands manage project environment variables.

user definedsecretsecret value

Location

secret store

Vercel project environment variables and encrypted deployment secrets

config file
vercel.json, .vercel/project.json, .vercel/.env.preview.local, .vercel/.env.production.local

.env, .env.local, vercel.json, and CI pipeline configuration; Removed generic/common scanner surface path(s) from product template: .env

source code

accidentally committed .env files, tests, and examples

logs

build logs and runtime logs if applications print environment values

Notes

Vercel environment secrets often contain downstream database URLs, API tokens, OAuth secrets, and cloud credentials. Environment variable storage noted but omitted from CredsHound location data because no exact variable name is documented: runtime and build-time environment variables exposed to Vercel functions/builds

03

Vercel AI Gateway API Key

vercel / ai-gateway-key

Vercel AI Gateway uses API keys/tokens for model gateway requests and provider routing. This is Vercel-specific AI credential behavior and belongs in the Vercel product entry rather than a separate detector-named template.

generated on installuser definedsecretAPI key

Looks like

example
example

Vercel AI Gateway API key shape from public scanner rules

vck_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123

Location

http header
Authorization

Bearer/API key used for Vercel AI Gateway requests

environment
AI_GATEWAY_API_KEY, VERCEL_AI_GATEWAY_API_KEY
config file
ai-gateway.json, vercel.json, vercel-ai.json

AI SDK configs, agent configs, .env files, Vercel project settings, integration configs, and examples; Removed generic/common scanner surface path(s) from product template: .env

secret store

Vercel project environment variables, CI/CD variables, cloud secret managers, and developer vaults

source code

AI app code, notebooks, examples, tests, and model routing configs

logs

AI SDK traces, gateway logs, runtime logs, and failed model request debug output

Notes

Covers Betterleaks rule vercel-ai-gateway-key without creating a separate non-product template.

04

Vercel Integration Token

vercel / integration-token

Vercel integrations and marketplace/app installations can issue integration tokens, access tokens, and app credentials for project, team, deployment, or environment-variable automation.

generated on installuser definedsecrettoken

Location

http header
Authorization

Bearer token used by Vercel integrations and app-installation API calls

http response

integration install, OAuth, or token creation responses containing access_token or refresh_token fields

config file
vercel-integration.json, integration-token.json, oauth-token.json

integration manifests, app backends, OAuth configs, .env files, and deployment settings; Removed generic/common scanner surface path(s) from product template: .env

environment
VERCEL_INTEGRATION_TOKEN, VERCEL_APP_ACCESS_TOKEN, VERCEL_APP_REFRESH_TOKEN
secret store

Vercel integration secrets, Vercel project env vars, CI/CD variables, and app secret stores

source code

integration backends, marketplace apps, webhooks, tests, and examples

logs

OAuth exchange logs, webhook logs, integration logs, API traces, and failed auth errors

Notes

Covers Betterleaks rules vercel-integration-token, vercel-app-access-token, and vercel-app-refresh-token inside the Vercel product template.

05

Vercel OAuth Application Secret

vercel / oauth-application-secret

Vercel integrations and applications can use OAuth client secrets, webhook signing secrets, and callback credentials to authenticate app installs and event delivery.

generated on installuser definedsecretsecret value

Location

http header

webhook signature, app secret, or OAuth authorization headers

http response

OAuth token exchange responses and app-installation credential responses

config file
vercel-oauth.json, integration.json, app.json, webhook.json

OAuth app configs, integration manifests, webhook handlers, app settings, and .env files; Removed generic/common scanner surface path(s) from product template: .env

environment
VERCEL_CLIENT_SECRET, VERCEL_WEBHOOK_SECRET, VERCEL_INTEGRATION_SECRET
secret store

OAuth client secret stores, Vercel environment variables, CI/CD variables, and cloud secret managers

source code

integration source repos, callback handlers, webhook handlers, and tests

logs

OAuth callback logs, webhook delivery logs, and integration debug traces

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.