April 23, 2026

After the Vercel security incident on April 19, a claim appeared on X and other networks that it is time to move web applications from Vercel to VPS. The same could be said of any managed hosting provider, since they all have similar advantages and disadvantages.

Below we examine whether a VPS actually provides a higher level of security and in which cases it is justified.

Security

A VPS is not a more secure option. Security remains a complex area, and when you use a VPS, responsibility for it rests entirely with the user.

The Vercel Incident

In the Vercel incident, the problem was an employee account. The vulnerability was related to how Vercel's internal operations were organized: a single compromised user or employee account could affect the entire system.

When using a managed service, security depends largely on the measures the provider implements.

Responsibility When Using a VPS

On a VPS, the user is responsible for all levels of protection. Security setup includes, for example:

• SSH protection, so that outsiders cannot connect to the server;
• automatic package updates, so that software stays up to date to the extent that automation allows.

However, these measures do not cover everything. Vulnerabilities appear in many components of the system that runs a web application.

Example: React Server Components Vulnerabilities

Last year, vulnerabilities were discovered in React Server Components. One specific vulnerability allowed attackers to gain control of a machine and execute code on it.

The only way to protect against this was to promptly install the update released for React and Next.js. This example is not the only one: vulnerabilities can appear in any component of web infrastructure.

Protection When Using Vercel

When using Vercel, part of the protection is provided automatically by the provider. After the React Server Components vulnerability was discovered, Vercel deployed automatic protective measures through its web application firewall (WAF) service. This did not guarantee complete protection, but it added an extra layer of security, and users did not have to take any action.

Similar protection could be applied to other vulnerabilities as well.

Security Conclusion

A managed service such as Vercel usually makes security easier to maintain, although it is itself subject to vulnerabilities. Attacks like the April incident are possible in both cases. With a VPS, the entire responsibility for protection lies with the user, and this has its drawbacks.

Cost

Cost is one of the main reasons to choose a VPS.

• Predictability. A VPS can be very affordable. For example, a VPS from Hetzner can be rented for a few dollars a month, and the payment amount remains constant.
• Pricing of managed providers. The pricing systems of such services can be complex, and users often receive unexpected bills. Reports of charges significantly exceeding the expected amounts regularly appear.

Responsibility for such bills lies mainly with users; however, the complexity of pricing is partly a consequence of decisions by providers who are interested in keeping it that way. It is not possible to clearly divide providers into good and bad ones.

On a VPS you can run web applications that could cost tens or hundreds of dollars with a managed provider, for roughly 20 dollars a month. This difference in cost is one of the main advantages of a VPS and the most significant reason to choose it over a managed provider.

Flexibility

A VPS offers extensive configuration options, since it is essentially a computer, usually running a Linux operating system. Although you can rent a VPS with other systems, Linux remains the standard choice.

On a VPS you can:

• install any software;
• run any processes;
• create users and configure the system as you see fit.

Restrictions are imposed only by some providers, which block certain ports needed for standard workflows and applications.

With managed providers, capabilities are limited to the set of features the provider supports. For example, Vercel does not support SQLite. Therefore, an application using SQLite cannot simply be built locally and deployed to Vercel without changes.

SQLite, however, is a reliable solution for many web applications. It is not a toy for development: it can be used in production, and it is easy to install, configure, and manage. On a VPS, an application using SQLite can run without additional changes.

Skill Requirements

The flexibility advantage comes at a cost: the user needs to understand Linux and be willing to learn how it works. Artificial intelligence simplifies this process by helping with VPS setup, understanding Linux commands, and composing complex command chains where the output of one command is passed to another. In the author's experience, this is now much easier than it used to be, but the need to figure out the system on your own remains.

The Simplicity of Managed Providers

With a managed provider, it is usually enough to push code to GitHub. With the right configuration, the application is automatically deployed with the new version. Rolling back to previous versions is also simple.

The price of this simplicity is limited functionality.

Comparison

Summary

The choice between a VPS and a managed provider depends on priorities:

• A VPS suits those who value cost, predictable expenses, and flexibility. It can also be used to host web applications, run workflows, or operate AI agents such as OpenClaw. This choice requires readiness for more complex setup and knowledge of Linux.
• A managed provider suits those who value ease of use. You pay for it with money.

If security is the primary criterion, a managed provider is preferable. A VPS is not a simpler or more secure option.