Every PaaS Breach Becomes an AWS Breach

Vercel's April 2026 breach is the third major PaaS-credential incident in four years. Heroku, CircleCI, and Vercel all followed the same shape: a vendor-side endpoint compromise that ended in customer AWS keys being exported in bulk. The platform changes. The mechanic does not.