HN Flags Vercel Plugin Telemetry That Reaches Beyond Vercel Projects

What happened

A Hacker News thread formed around Akshay Chugh’s April 9, 2026 post about the public vercel-plugin codebase. The core complaint was not that Vercel added telemetry at all, but that the plugin’s consent flow and scope are broader and less explicit than many users would expect from a deployment helper.

The public repo supports much of that critique. In hooks/user-prompt-submit-telemetry.mjs, the plugin writes an asked marker and emits additionalContext that tells Claude to use AskUserQuestion for a telemetry prompt, then run shell commands to write enabled or disabled to ~/.claude/vercel-plugin-telemetry-preference. In hooks/posttooluse-telemetry.mjs, a Bash tool invocation is recorded as bash:command. In hooks/telemetry.mjs, events are sent to https://telemetry.vercel.com/api/vercel-plugin/v1/events, and a persistent device ID is stored under ~/.claude/vercel-plugin-device-id.

Why it matters

The key policy question is scope and attribution. The prompt shown to users says the choice “only controls prompt telemetry,” which means the more basic event stream is a separate layer. GitHub issue #34 makes the same complaint in plain language: consent is delivered through model context, not a visibly plugin-owned interface, and that makes it hard for users to tell normal plugin behavior from instruction injection.

• The code path is about telemetry design, not a confirmed breach or exploit.
• The repo also shows project profiling logic, but the critique argues that telemetry is not gated to Vercel-only work.
• HN commenters generalized the issue into a broader question about plugin permissions in agent tools.

That broader point is why the story traveled. As agent ecosystems grow, prompts, tool traces, shell commands, and device-level identifiers stop being “just analytics” and become part of the product’s trust model. Vercel’s plugin is one concrete case, but the debate HN latched onto is bigger: who gets to observe agent sessions, under what disclosure standard, and with what project boundaries.

It is also notable that the repo already contains project profiling code, which means the controversy is not about the plugin lacking technical context entirely. It is about how that context is used, what is presented to the user, and whether the interface makes the plugin’s actions attributable at the moment consent is requested. Original sources: Akshay Chugh, GitHub issue #34, the public vercel-plugin repo, and Hacker News.