Vercel Plugin Secretly Logs Bash Commands

A Vercel plugin integrated within Claude Code has been identified collecting telemetry data by default, including comprehensive bash commands and sensitive environment variables. This data collection occurs even in projects lacking any Vercel configuration files or dependencies. The plugin employs system-level instruction injection to present consent requests, making them indistinguishable from native interactions.

Session-level data, such as device identifiers and operating system details, is transmitted at the start of each session without explicit user opt-in. Critically, the plugin captures the full content of bash command strings, potentially exposing sensitive information like file paths and infrastructure details. This automatic collection happens independently of user consent for prompt sharing.

Disabling this telemetry requires manual intervention through less accessible documentation and configuration options. The plugin's data collection mechanisms are not limited to Vercel-specific environments, operating universally across all projects within Claude Code. This behavior contrasts with the plugin's project detection logic, which is not applied to limit telemetry activation.