I'd love more detail on this. We have made major investments in open source and ensuring Vercel is an open platform.
◆ The Vercel Build Output API exposes all the underlying primitives of the platform for every framework to take advantage of (https://vercel.com/blog/build-output-api)
◆ We've diligently invested in standard-compliant API signatures. Serverless Functions adopted the Node.js request / response standard (as opposed to e.g.: AWS Lambda inventing a new one) and Edge Functions adopt the Web standard. We've joined WinterCG to foster this standardization effort (https://wintercg.org/)
◆ We've always invested in API compatibility between local development, self hosting and Vercel infrastructure (e.g.: `vc dev` is open source https://github.com/vercel/vercel).
◆ We're continuing to invest here. Next.js and Vercel build outputs are always getting more detailed, we're exploring support for running build outputs locally (`vc start`) as an open source offering, etc.
> they don’t seem to care much about security
We added support for your feature request, and security remains the top priority of the company. Some recent ships:
◆ https://vercel.com/changelog/access-tokens-can-now-be-scoped...
◆ https://vercel.com/changelog/share-environment-variables-acr...
◆ https://vercel.com/changelog/expiration-dates-now-available-...
◆ https://vercel.com/changelog/protected-preview-deployments-a...
◆ https://vercel.com/changelog/increased-security-with-view-on...
◆ https://vercel.com/changelog/enhanced-security-with-new-api-...