This version was translated from the original Chinese by AI.

October 11, 2026 · Elliot Hu

The Hypocrisy of Vercel

In the entire catalog of Silicon Valley grifts, nothing turns my stomach quite like talking out of both sides of your mouth.

If there's one company in modern web development that has turned "preaching open-source purity while running a proprietary tollbooth" into an Olympic sport, it’s Vercel.

A valuation flirting with $10 billion, an Argentine wunderkind CEO in Guillermo Rauch, and an absolute chokehold on the modern frontend ecosystem via Next.js. In the spotlight, Vercel’s brand is surgically sterile: sleek monochromatic minimalism, endless religious chanting about "Developer Experience" (DX), the benevolent patron saint of open source, and a tireless crusader against evil vendor lock-in.

Strip away the keynote slides, the army of sponsored influencer shills, and the relentless PR spin, and only one word remains: sanctimony.

I'm not going to play nice, and I'm not here to offer "balanced, nuanced takes." Let's pull the receipts, look at the tweets, and walk through the real-world trainwrecks to expose just how hypocritical this self-proclaimed frontend lighthouse really is.

01｜The Preacher's Racket: Crying "Anti-Lock-in" While Welding the Gates Shut

Mr. Rauch might just be Silicon Valley's most accomplished performance artist when it comes to the pot calling the kettle locked-in.

In November 2025, the CEO took to X with tearful solemnity to share his company’s manifesto, The anti-vendor-lock-in cloud, preaching like a tech-evangelist on a soapbox:

“In 2025, you no longer have to write your application for a specific cloud vendor or runtime. You should be able to grab e.g. your @nodejs/@bunjavascript codebase, Postgres db, and run it anywhere.

Your “lock-in” can actually be easily quantified: grep for the vendor name, deps, and specific runtime APIs in your codebase. Look at the length of your toml config. Watch for vite-plugin-vendor to paper over incompatibilities with the standard runtime.

Our commitment is rooted both in portability and ease of use. We believe configuring your runtime or app for Vercel is not a good experience. And it’s altogether a net negative for the world.”

Rauch on Vercel's anti-vendor-lock-in stance

Screenshot: Rauch's original post

It sounds poetic. But any engineer who has ever tried migrating a real-world Next.js app off Vercel can only laugh bitterly. In this ecosystem, the single biggest, sneakiest, and most universally loathed proprietary lock-in is Next.js itself.

Back in 2022, Vercel launched a public Build Output API on its platform. In theory, any framework that complied with this specification could run smoothly on Vercel. The punchline? Next.js—Vercel's very own flagship cash cow—never bothered to follow its own public spec.

For years, the .next build output remained a private, undocumented black box. Netlify's engineering team pulled back the curtain in their blog post Next.js Deployment Challenges: to run customer Next.js apps, Netlify, Cloudflare, AWS Amplify, and SST had to reverse-engineer Vercel’s bespoke disk output year after year, stitching together digital duct tape to make it work.

That is literally why OpenNext exists—an open-source project born out of sheer communal desperation. Competing cloud providers were forced to pool engineering budgets just to reverse-engineer and clean up the mess left behind by a framework that claimed to be "open source" and "anti-lock-in."

In October 2024, Netlify CEO Matt Biilmann announced they were joining OpenNext, spelling out the grim reality: "Netlify is the only place outside of Vercel where Next can be deployed on a serverless front-end cloud with support for all the advanced features."

Biilmann announcing Netlify joining OpenNext

Screenshot: Biilmann's 2024 post

In September 2025, when a user complained about deployment headaches on Netlify and crawled back to Vercel, Biilmann replied candidly: "We had a painful re-architecture of our approach to Next that landed last year and now have what's probably the largest test suite for Next JS functionality running nightly against our platform."

Biilmann replying to Next.js deployment issues

Screenshot: Biilmann's 2025 reply

The entire industry felt this pain. On March 21, 2025, when someone asked Replit CEO Amjad Masad on X whether they planned to support Next.js, Amjad gave the most honest answer in tech:

“Next.js is primarily made for Vercel and requires a ton of investment to make it work outside. Things like OpenNext exist but we’d rather bet on truly open frameworks like Vite.”

Amjad Masad on the external cost of running Next.js

Screenshot: Amjad's original post

Lee Robinson, then VP of DevRel at Vercel, jumped in with peak gaslighting: "Replit can deploy VMs, right? All Next.js features should be supported then."

What a bad-faith deflection. Sure, if you spin up a heavyweight Node.js monolith in a container, it boots. But is that what you sold people as modern, distributed frontend infrastructure? Give me a break. Let's look at the facts:

next/image in self-hosted mode defaults to eating up local compute; if you want edge optimization, good luck rolling your own service. On Vercel? Magically wired into their global edge.
ISR and Data Cache explicitly state in self-hosting docs: cached on local disk by default, not shared across instances. Want multi-instance caching? Write your own custom cacheHandler and kill memory caching. On Vercel? Instant global cache with 300ms purges.
Middleware was hardcoded to internal proprietary headers like x-middleware-subrequest to bind directly to Vercel's edge routing.

It wasn't until April 2025, under relentless pressure, that Vercel finally published a Deployment Adapters RFC. That stable adapter contract didn't actually land until Next.js 16.2 a full year later. Before that, "vendor-neutral" was nothing more than a hollow marketing slogan.

And Rauch’s personal hypocrisy is on another level.

On February 25, 2026, Rauch posted an official guide on how to migrate from Cloudflare to Vercel. When someone brought up Cloudflare’s Durable Objects (DO), Rauch couldn't resist clowning:

“One is an industry standard and open source datastructure server [Redis], the other one is… actually no one knows what DO actually is 😂 (other than lock-in for workers)”

Cloudflare engineer Ashley Peacock immediately fired back, pointing out that comparing Redis to Durable Objects is absolute nonsense. Then Cloudflare engineer Dillon Mulroy took the gloves off and exposed Vercel completely:

Rauch's thread on Durable Objects

Ashley Peacock replying to Rauch on Durable Objects

Screenshots: Rauch's reply, Ashley Peacock's reply

“fun fact, https://vercel.com/domains backend architecture is inspired by durable objects.

we didn't build it on fluid compute b/c we couldnt have function/session affinity and the network latency w/ redis instead of sqlite on disk (and resumable streams) killed perf”

In public, sneer at your competitor's technical breakthroughs as "lock-in." In private, fall back to Redis because your own edge architecture couldn't handle low-latency state. Making billions off proprietary black boxes while pretending to be the patron saint of open standards—if that's not talking out of both sides of your mouth, I don't know what is.

02｜God-Tier Keynotes, Dumpster Fires in Production

Vercel’s signature playbook: promise a silver bullet on stage, and leave you holding a flaming bag of garbage in production.

Remember the fever pitch at Next.js Conf in October 2022? The keynote slides practically blinded everyone with massive typography: Turbopack (alpha) — 700x faster than Webpack, 10x faster than Vite. Tech influencer swyx hyped it like the second coming: "The Third Age of JavaScript is here!"

Five days later, Vue and Vite creator Evan You ran the actual numbers and publicly dismantled the charade. Using SWC to transform React refresh in realistic conditions, root component updates took 338.2ms on Vite vs. 334.6ms on Turbopack; leaf updates took 141.8ms on Vite vs. 84.4ms on Turbopack.

"10x faster"? "700x faster"? It was pure marketing sleight of hand cooked up in cherry-picked micro-benchmarks.

Evan You discussing Turbopack vs Vite benchmarks on GitHub

Screenshot: Evan You's benchmark discussion

The hype was a lie, and the delivery was a joke. An alpha toy showcased on stage in 2022 took two full years just to lose its experimental flag in local dev (October 2024). Making it the default production bundler took three full years, dragging out until Next.js 16 in late 2025.

And what did developers get for trusting the hype during those three years? A memory black hole.

GitHub issues like #61063 and Discussion #93451 piled up with horror stories. By Next.js 16.2.3 in May 2026, developers reported Webpack using 3 GB of RAM while Turbopack dev mode casually ballooned to 7 GB—and blew past 12 GB on modest projects with a few dozen routes.

Nearly a year after declaring it stable, Next.js lead Tim Neutkens had to jump on X in September 2025 to admit: "We've found and fixed a memory leak in Next.js when using Turbopack in development... One Turbopack trace we received showed a ~20% reduced memory usage."

Tim Neutkens on fixing Turbopack memory leaks

Screenshot: Tim Neutkens' original post

The caching saga was another masterclass in treating developers like unpaid guinea pigs.

In Next.js 13 and 14, leadership had the galaxy-brain idea to make fetch() cache aggressively by default. For two solid years, every frontend engineer on the planet was caught in a nightmare: data wouldn't update, databases were cached against their will, and quick prototyping became an exercise in pain.

After torturing the ecosystem for two years, Vercel dropped a breezy post in October 2024 titled Our Journey with Caching, sheepishly conceding: "Along the way, the developer experience suffered... The default for fetch() changed to favor performance by caching by default, but quick prototyping and highly dynamic apps suffered." They flipped the default right back in Next.js 15. Then they turned cookies() and headers() into async calls, renamed the vulnerability-riddled middleware to proxy, and had the nerve to scold the community: "don't overuse it."

SST co-founder Dax (@thdxr) posted a 13-second video in March 2025, speaking for every exhausted dev on the planet:

“the levels of jank being shipped has gotten pretty bad

before you reply with the excuses i know

nextjs can deliver good experiences

this is related to app router migration

but idc - end results are bad industry should shut up about how to build apps till this is fixed”

Dax criticizing Next.js DX

Screenshot: Dax's original post

Meanwhile, over at Vercel Labs, half-baked prototypes were getting cranked out like cheap vaporware:

Zerolang: Hyped in May 2026 as "the programming language for agents" to let AI write and repair native binaries. It farmed a few thousand stars, shipped v0.3.4 in mid-June, and immediately flatlined. One lone engineer pushes sporadic commits with months of radio silence in between.
Native SDK: The landing page brags: "The Complete Toolkit for Native Apps: one codebase compiles for macOS, Linux, Windows, iOS, and Android — no browser, no WebView, under 6 MB." Scroll down, and the house of cards collapses: iOS is simulator-only, Android has literally never run on real hardware, Windows/Linux rely on software rendering, and right next to "no WebView" sits an optional WebView panel.

Huge headlines screaming "REVOLUTIONARY, BLAZING FAST, GROUNDBREAKING," while the actual disclaimers are buried in microscopic fine print in the morgue. Classic Vercel.

03｜The Open-Source Black Hole: Poaching React, Ditching Hyper, and "Fuck Your PRs"

There's a widespread myth that Vercel "saved the frontend ecosystem."

Does Vercel love open source? They love using open source as a lead-generation funnel for their cloud markup.

To take total control of frontend architecture, Vercel backed up the Brink's truck and poached practically the entire React core team. When React joined the Linux Foundation, almost every non-Meta seat on the committee belonged to Vercel: Sebastian Markbåge, Andrew Clark, and former Meta director Tom Occhino. React 19 and React Server Components (RSC) were framed as community standards, but operated in practice as a multi-year sales pitch for Next.js App Router and Vercel's serverless compute billing.

Redux maintainer Mark Erikson pointed out in his 2025 reflection, quoting Dan Abramov: Vercel poured countless full-time engineers into building what the React team wanted, and Next.js was basically rewritten from scratch to fit RSC. The end result? The technical future of the entire React community was hijacked into an R&D testbed for Vercel's cloud balance sheet.

And what happens to projects acquired without an obvious hosting monetization angle?

Look at Hyper, the once-glorious terminal emulator with 45k GitHub stars that Rauch personally fathered. Post-acquisition, it sits abandoned in a ditch. On Issue #8070, longtime user adrwh pleaded: "9 months now with no updates. Blog articles said you were in for the long haul, what happened?" The comments are a graveyard of unanswered questions, forcing the community to maintain third-party forks.

Hyper users questioning maintenance status on Issue #8070

Community contributors explaining unofficial Hyper forks

Screenshots: Hyper Issue #8070 and replies

Their contempt for ordinary community contributors is even more brazen.

When AI SDK piled up over 1,000 issues and 800 PRs, Vercel built a "software factory." Engineer Lars Grammel explained that because their internal bot setups had a proven track record: "we trust our own internal agent configurations more than community member agents."

Within four weeks, they proudly announced their bots had closed 70% to 80% of issues. Community developers taking the time to submit PRs? Filtered out like spam.

Open source to Vercel isn't a collaborative commons; it's a vanity billboard to farm clout, brag about being "open," and mass-close community contributions with internal bots.

04｜Shameless Double Standards: Free Users Are Just Unpaid Training Slaves

If technical games can be excused as ruthless business, the March 2026 Terms of Service update showed just how low Vercel's ethical bar actually is.

In March 2026, Vercel quietly pushed an update to its terms:

For all Hobby (free tier, including Trial Pro) users, private repos deployed on the platform, telemetry data, build errors, and agent chat logs would now be used by default to train Vercel’s AI models—and could be shared with third-party AI providers.

Talk about absolute highway robbery.

You thought you were hosting a side project; Vercel treated your private source code as free kibble to train its commercial AI empire.

And the opt-out mechanism was a masterclass in class warfare:

Paid Pro users? Opted out by default.
Enterprise whales? Completely exempt.
Only broke Hobby developers were shanghaied into the AI training pool by default!
If you didn't want your private code farmed, you had to navigate a maze of team settings to manually opt out before March 31, 2026. Miss the deadline? Anything already harvested and shared with third parties "cannot be revoked."

Ebenezer Don sounded the alarm on X: "For Hobby users, Vercel will now be training their AI models on private repos you deploy through their platform. They may also share these repos with third-party AI providers." Tech For Palestine launched boycotts and migration guides.

Ebenezer Don warning Hobby users about AI terms

Screenshot: Ebenezer Don's original post

To Vercel, free users aren't the foundation of open source; they're unpaid lab rats trading private IP for breadcrumbs of free compute. When Chinese AI lab Zhipu got caught scraping private repos, they at least hit the deck and issued a groveling public apology. Vercel got caught red-handed, watched a global boycott unfold, and basically hit us with a "yeah, and what about it?" Truly visionary stuff!

05｜Bill Shock Ransomware and the Stockholm Syndrome PR Circus

"Deploy in seconds, scale globally." That's the honeyed trap.

Deploy a project that catches real traffic, and your invoice will make offshore crypto scams look like registered charities.

Vercel’s meter-running line items are an absolute work of art: Fast Data Transfer ($0.15/GB), Fast Origin Transfer ($0.06/GB), function runtimes, Edge Requests per million, and separate micro-fees for Data Cache reads and writes. One accidental loop or viral tweet, and you're staring down financial ruin.

Under traffic surges and DDoS attacks, the contrast is humiliating:

On September 27, 2026, developer Bart shared invoices showing identical traffic: Cloudflare charged $0, Vercel charged $40+. Caption: "this hits different."
Developer Shane Levine joked after getting hit with a $369 invoice for BeautifulUI: "We finally answered the question: 'Should designers code?'"
On Reddit's r/nextjs, an employee shared how a tiny blog with light ISR racked up an unexpected $1,141.89 bill without any traffic surge in Google Analytics—over a grand of it purely in bandwidth.
Cara founder Jingna Zhang shared that when traffic blew up, a provider slammed them with a $100k bill for one week, with community screenshots pegging Vercel Serverless at roughly $96,000.

Bart comparing Vercel and Cloudflare bills

Screenshot: Bart's original post

And out of this predatory metering emerged a bizarre ritual of corporate clemency.

In September 2026, RareUI creator Swami was hit by a DDoS attack and faced a massive bill. He begged for help on X, Vercel PR swooped in to waive it, and Swami posted an effusive love letter:

“Another W for open source Yesterday, https://www.rareui.com/ got hit by a DDoS and I ended up with a massive Vercel bill. It was honestly a bit stressful since RareUI is completely open source and it's entirely free...

I reached out to @sonofalli and she helped me get the entire bill waived. This is the kind of support that makes a real difference for OSS. I genuinely don’t see myself moving RareUI off Vercel after this.

Huge thanks to @rauchg, @sonofalli, and the entire @vercel team for supporting open source developers, even outside the Vercel OSS Program. This kind of support genuinely means a lot.”

RareUI creator stating Vercel waived DDoS bill

Screenshot: Swami's original post

Hard spend limits took years of community fury to implement—and still don't pause deployments by default. Instead, infrastructure failures are reframed into staged PR spectacles of benevolence. The victim gets shaken down, gets a royal pardon, and turns into an unpaid hype man. Peak Stockholm Syndrome. Thoughts and prayers.

06｜Fragile as Glass, Loud as Hell: Clowning on "Vibe Coding" Right Before Getting Pwned

When it comes to security, Next.js and Vercel have been an open ATM for attackers.

In March 2025, CVE-2025-29927 dropped with a CVSS 9.1 rating. Next.js used an internal header x-middleware-subrequest to prevent recursion; any external request supplying that header completely bypassed all middleware route authentication! The front door was wide open.

The vulnerability was reported in late February, but Vercel sat on it for weeks, quietly altered logs, and tried to spin the fix as routine maintenance.

Amjad Masad completely lost his patience on X:

“If I was Vercel’s CEO I would be spending all my time supporting my customers and community in patching a security vulnerability that:

Vercel sat on for days

Dishonestly tried to spin into a marketing event

Silently changed their logs

Still haven’t provided clarity for customers

But what is he doing?

Calling me a liar for pointing out the obvious that Nextjs is primarily made to run on Vercel.

Any external provider or anyone self-hosting would attest to the pain, money, and time it takes.”

Amjad Masad rebuking Vercel's vulnerability handling

Screenshot: Amjad's original post

Vercel's postmortem added insult to injury, lecturing developers: "We do not recommend Middleware to be the sole method of protecting routes." You installed the deadbolt backwards and blamed the homeowner for trusting the lock.

Then came December 2025: React2Shell (CVE-2025-55182, a maximum 10.0 CVSS nuclear bomb). In default create-next-app projects with App Router enabled, an attacker could achieve near-100% remote code execution without a single line of custom Server Function code.

Shadowserver detected over 165,000 vulnerable IPs and 640,000 domains. Wiz found 39% of cloud environments exposed. 65% of exploit traffic was immediately co-opted by Mirai botnets and cryptominers. CISA had to issue an emergency directive ordering federal agencies to patch before Christmas.

2026 brought security patch dumps in bulk: 13 advisories in May covering WebSocket SSRF and middleware bypasses; 9 more in July; and critical RCEs in next/og ImageResponse alongside image optimization SSRFs in September.

Yet in the midst of this sieve-like track record, Rauch maintained an air of supreme moral superiority.

On February 26, 2026, days after Cloudflare released Vinext (an experimental Next.js runtime built with AI assistance), Rauch eagerly posted to 4,000+ likes:

“We've identified, responsibly disclosed, and confirmed 2 critical, 2 high, 2 medium, 1 low security vulnerabilities in Cloudflare's vibe-coded framework Vinext.

We believe the security of the internet is the highest priority, especially in the age of AI. Vibe coding is a useful tool, especially when used responsibly.

Our security research and framework teams are extending their help and expertise to Cloudflare in the interest of the public internet's security.”

Rauch announcing Vinext vulnerabilities and calling it vibe-coded

Screenshot: Rauch's original post

The pose of the selfless internet guardian was played to perfection.

Then came the punchline.

Just two months later in April 2026, Vercel’s own internal platform was completely pwned.

The entry point wasn't a zero-day: an employee connected third-party tool Context.ai to their corporate Google Workspace. Attackers hijacked the integration, traversed internal environments, and exfiltrated unmasked environment variables, API keys, GitHub tokens, and npm credentials. The stash was put up for sale on BreachForums for $2,000,000.

Interviewed by The Register, Rauch offered an excuse for the ages:

“I strongly suspect, significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel.”

When competitors experiment with AI, it’s amateurish "vibe-coding." When your corporate security falls apart from basic phishing, it’s a sophisticated "AI-accelerated assault." Masterclass in PR spin.

07｜The Emperor Has No Clothes: When Photo Ops and Hype Finally Implode

And then there was the political circus.

On September 29, 2025, Rauch proudly posted a photo on X with Israeli Prime Minister Benjamin Netanyahu, pontificating on how "AI education and literacy will keep our free societies ahead."

The tweet collected thousands of likes, but just seven hours later, Vercel employee Wesam quoted it with six devastating words:

“I just handed in my resignation at Vercel”

Wesam's resignation tweet quoting Rauch and Netanyahu

Screenshot: Wesam's original post

That tweet exploded to nearly 80,000 likes, triggering widespread boycott and migration calls. The carefully curated bubble of "open, inclusive, community-first" idealism burst in an instant.

Vercel's trajectory is a textbook Silicon Valley parable:

Lure developers with sleek aesthetics and polished DX;
Monopolize open standards and upstream core teams;
Cloak proprietary lock-in behind loud "anti-vendor-lock-in" slogans;
Exploit developer trust with predatory billing and invasive terms;
Drag entire engineering teams into security nightmares with fragile code.

Developers are voting with their feet. In State of JS 2025, Next.js satisfaction cratered, trailing leader Astro by nearly 40%. From Dax’s rants to migrations by Documenso and Lasse over to TanStack Start and Vite, the exodus is well underway.

When the gilded veneer peels away, what sits on that pedestal isn't an engineering lighthouse, but a tech clown fueled by greed, arrogance, and deception.

08｜A Word of Advice: Save Your Sanity and Stay Far Away from Vercel

To cut straight to the point: as a CTO and an engineer who has spent years in the trenches of frontend and cloud infrastructure, if anyone asks me what platform to choose today, my answer is unequivocal: I do not recommend Vercel for any production workload, personal or corporate.

The reasoning is grounded entirely in cold engineering and business reality:

First, everything Vercel can do, Cloudflare does better, faster, cheaper, and across a vastly broader product catalog. Many assume Vercel is an infrastructure heavyweight; in reality, it's a glorified wrapper reselling upstream compute and bandwidth at an eye-watering markup. Cloudflare owns hundreds of physical points of presence on a private global network, giving them an insurmountable structural advantage. Whether it's static assets, serverless Workers, globally distributed KV/D1/Hyperdrive, or stateful Durable Objects, Cloudflare delivers generational leaps in latency, throughput, and reliability. And R2's elimination of egress fees runs circles around Vercel's predatory Fast Data Transfer tolls. For $5, Cloudflare handles tens of millions of requests; on Vercel, that same traffic will give your wallet a very painful reality check.

Second, in the age of AI, Vercel's vaunted "DX advantage" is evaporating at lightspeed. Vercel rose on the back of zero-config deployments for developers who couldn't be bothered with DevOps. But in 2026, when every engineer has Codex or Claude Code at their fingertips, generating and debugging a Wrangler config, Dockerfile, or deployment script takes seconds. The mental friction that once justified Vercel's DX premium has dropped to zero. When the convenience moat vanishes, competition returns to raw infrastructure quality, honest pricing, and operating efficiency. Vercel loses on all three counts.

Third, from a business perspective, I am deeply bearish on Vercel's future. Without proprietary physical datacenters or a global backbone, gross margins are squeezed by upstream providers. Its flagship framework Next.js has exhausted community goodwill, shredding its open-source credibility. It resorts to scraping free user code to train AI models while extracting rents through bill shock. As the industry migrates toward Vite, TanStack, native Web standards, and open edge computing, Vercel is caught in an ever-tightening vice. When a platform is neither open, nor cheap, nor secure, relying solely on marketing spin and keynote hype, its decline is only a matter of time.

The choice is yours. Migrate your code, disconnect your credit card, and stop worshiping at the altar of a false cyber-idol.