Fake Vercel / Netlify / Cloudflare-Pages PR-preview env-var exfil click-through lure — "Vercel preview ready — review env scrape route" / "Netlify deploy preview exposes process.env.NEXT_PUBLIC_API_KEY and adds a /api/_debug endpoint dumping the full env." Sender NOT on the canonical preview-deploy / SCM allowlist (vercel.com, vercel.app, netlify.com, netlify.app, cloudflare.com, pages.dev, workers.dev, github.com, githubusercontent.com, githubapp.com, gitlab.com, bitbucket.org, render.com, fly.io, railway.app, heroku.com, firebase.google.com, amplifyapp.com, amazonaws.com). Real preview-deploy notifications come from the canonical preview-deploy vendor and do not advertise env-var exfil endpoints — they link to the verified preview URL and ship from the vendor's no-reply address. Distinct from R7 GHA-disclosure-lure and R8 cloud-build-matrix — this signal is specifically the *PR-preview env exfil* pretext (Vercel deploy-preview workflow where the PR-preview branch exposes `process.env.NEXT_PUBLIC_*` and accidentally leaks server-side env vars via a `/api/_debug` route added in the PR; the lure click-through scrapes the env). Source: Red-Team R8 multi-agent council S1 (supply-chain specialist).
vercel-pr-preview-env-exfil-lure
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake Vercel / Netlify / Cloudflare-Pages PR-preview env-var exfil click-through lure targeting front-end engineers and Next.js / SvelteKit / Astro maintainers. The phish narrative arrives as: "Your Vercel preview deployment is ready for review. The preview branch exposes process.env.NEXT_PUBLIC_API_KEY and adds a /api/_debug route that dumps server-side env vars. Click below within 24 hours to review the deploy preview. Action required," or "A new Netlify deploy preview branch has been built. The preview exposes process.env.NEXT_PUBLIC_* and adds an /api/_debug endpoint dumping the full env. Please click below within 48 hours to review the preview deploy. Mandatory." The PR-preview env-exfil attack pattern: an attacker opens a PR against the maintainer's repo that adds a `/api/_debug` route or similar endpoint exposing `process.env.NEXT_PUBLIC_*` and accidentally-leaked server-side env vars. The auto-built deploy-preview is then advertised in a Renovate-styled / Vercel-styled email lure asking the maintainer to "review the deploy preview." When the maintainer clicks through to the preview URL, the attacker-controlled `_debug` route renders the env in the response, scraped by the attacker via prepared headers / iframes. Real preview-deploy notifications come from the canonical preview-deploy vendor (vercel.com, netlify.com, cloudflare.com, etc.) and link to the verified preview URL — they ship from the vendor's no-reply address and do not advertise env-var exfil endpoints. Sender NOT on the canonical preview-deploy / SCM allowlist (vercel.com, vercel.app, netlify.com, netlify.app, cloudflare.com, pages.dev, workers.dev, github.com, githubusercontent.com, githubapp.com, gitlab.com, bitbucket.org, render.com, fly.io, railway.app, heroku.com, firebase.google.com, amplifyapp.com, amazonaws.com). Distinct from R7 GHA-disclosure-lure and R8 cloud-build-matrix — this signal is specifically the *PR-preview env exfil* pretext (Vercel deploy-preview workflow). Fires when body references "vercel (preview/deploy(ment) preview)" / "netlify (deploy) preview" / "cloudflare-pages preview" / "pr-preview" / "deploy-preview" / "preview (branch/deployment/deploy)" / "preview ready" AND "process.env(.NEXT_PUBLIC*|.<VAR>)" / "env vars?" / "env-var(iable)?s?" / "NEXT_PUBLIC_*" / "/api/_debug" / "api _debug" / "_debug (route/endpoint)" / "debug (route/endpoint) that dumps" / "server-side env (vars/variables)" / "env scrape" / "env (dump/exfil/leak)" AND "click (below/here) (within/to (review/view))" / "review (the) (deploy preview/preview/preview deploy(ment)/env)" / "view (the) (deploy preview/preview/preview deployment)" / "please click (below/here/on)" AND within N hours-days / 24-48 hours / action required / mandatory / "preview (will) (expir/reject/removed)" urgency. Excludes the canonical preview-deploy / SCM / cloud-host domains. Auto-classified as danger via the `-lure` suffix. Source: Red-Team R8 multi-agent council S1 (supply-chain specialist).
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started