told claude to "just tidy the deploy config" before a friday demo.
it replaced my 14-line vercel.json with a turbo monorepo setup we don't have. preview urls all 404'd. local vercel build still worked which made me waste 40 minutes staring at the wrong machine.
rolled back from git history. now the file is in the denylist. anyone else getting "helpful" rewrites of deploy config that only break in preview?
Tried Cody on our 9 package monorepo this week after Cursor kept inventing helpers that already live in packages/shared . First index took 18 min on M2. After that it actually cited the right createB…
Two eng team. Launch Monday. I asked Claude Code Friday night to "prep the webhook PR". Woke up to three open PRs, zero plan docs, and one that quietly dropped our idempotency key check on the Flutte…
asked cursor to "clean up the theme a bit" before a friday review. woke up to 180 files where color brand 500 became 6366f1 . figma still has the tokens. the PR is 4k lines of noise and zero visual c…
5 comments
Join the discussion
Log in to comment.
hit this last week on a Next 15 app. agent swapped
rewritesfor aroutesblock that exists in Next config, not vercel.json. previews returnedDEPLOYMENT_NOT_FOUNDwhilevercel buildon my M2 stayed green.check the Vercel dashboard build logs for the rewritten
outputDirectory— mine pointed at.next/standaloneeven though we never enabled standalone. denylist alone wasn't enough; I added a CI step thatgit diff --exit-code -- vercel.jsonagainst main.put
vercel.json,turbo.json, and.github/workflowson a hard denylist last month. agents treat "tidy" like a rewrite invitation.also: if local build works and preview dies, check the deploy root first. mine had rewritten
rootDirectoryto a package that only exists in its imagination.yeah the imaginary package thing got me too
mine invented
apps/web-v2as rootDirectory. folder never existed. local still fine because i was running from the real rootdenylist helps. i also put a one-line comment at the top of vercel.json that says DO NOT REWRITE — agents still try but at least the PR review catches the tone
Same class of failure we see with infra-as-code agents. Green local build is not a release gate.
We require a human ack on any change under deploy/ and .github before merge. Without that, preview breakage shows up as a "site is down" Slack ping, not a failed CI check. Worth adding a tiny workflow that fails if vercel.json drifts from a known hash.
The hash-gate idea is good. We did something messier on our Mintlify docs site: a tiny Actions job that curls the preview URL and fails the PR if it gets 404 for more than 2 minutes.
Human ack on deploy/ still matters more though. Last Friday an agent "cleaned up" vercel.json before a launch thread went out, and support got three Slack pings before CI even noticed. Readers bounce faster than engineers file bugs.