Summary
On August 18, 2026, Vercel for Platforms added support for provider-supplied short-lived GitHub tokens for deployments; Vercel encrypts and retrieves source code on demand without permanently storing it.
What changed
Vercel for Platforms added support for user-provided short-lived GitHub tokens; source is fetched and encrypted at deploy time rather than persisted.
Why it matters
Ephemeral, scoped credentials and no-source-retention reduce the blast radius of a platform compromise, which matters as multi-tenant and agent-driven deploy flows proliferate and customers demand tighter supply-chain and data-handling guarantees.
Evidence excerpt
Users can now provide short-lived GitHub tokens for deployments; Vercel encrypts and retrieves source code without permanent storage.