Is it safe to give a mobile app your Vercel token?

What a token can actually do#

Most people picture "sees my deploy status". The real surface is wider — full breakdown here. The headline is that environment variables are readable, and that is where your real secrets live.

This is not hypothetical. In April 2026 Vercel disclosed a supply-chain incident via a compromised third-party OAuth application in which customer environment variables were exposed — API keys, database credentials, signing keys. The attack path was a third party with legitimate access, which is precisely the risk you take on every time you grant a token.

The checklist#

Apply this to any app, including ours.

1. Where is the token stored? On-device in the platform keychain is the strong answer. Stored on the vendor's server is not automatically wrong, but you should know, and it should be encrypted at rest.

2. Is server-side storage opt-in? Anything that polls while your phone is asleep needs a server-side copy — that is unavoidable physics, not a design failure. What matters is whether it happens by default or by your choice.

3. Is any of it open source? You cannot audit a closed iOS binary. You can audit a CLI.

4. Does it tell you what it reads? An app that reads env vars and does not say so is the one to worry about.

5. Can you revoke without them? Always yes on Vercel — account settings, tokens, revoke. Test it once so you know where the button is before you need it.

Applying it to MONII#

Since this page recommends being sceptical, here are our own answers:

• Storage: iOS Keychain via expo-secure-store. For the CLI, ~/.monii/auth.json at mode 0600.
• Server-side: only if you switch on background monitoring. It is off by default. Turn it on and an encrypted copy is stored (pgcrypto) so the polling job can run while the app is closed. Leave it off and the token never leaves your device — and alerts only fire while the app is running.
• Open source: the CLI and MCP server are. The iOS app is not.
• What it reads: deployments, usage, project config, domains, and environment variables — the last of which is gated behind Face ID in the UI, though the token itself can read them regardless of what the UI does.
• Revoke: your Vercel dashboard. Immediate, no cooperation needed from us.

The honest caveat: "tokens stay on your device" is true of the default configuration and not true once you enable background monitoring. Any product claiming both continuous alerting and zero server-side credentials is misdescribing how servers work. We would rather explain the trade than blur it.

The practical advice#

• Do not use a shared team token for a third-party app. Issue one you can revoke without breaking anything else.
• Scope to the team you need, not everything you have access to.
• Revoke tokens for apps you stopped using. Vercelios is gone; if you granted it a token, that token is still live.
• Rotate after any incident, yours or a vendor's.

Questions people actually ask