Vercel Sandbox exposed recycled disk blocks across deleted tenant sandboxes

The storage finding crosses a different boundary from an active guest-to-host escape. A sandbox can be deleted while physical or logical blocks remain allocated in a shared device-mapper backing system. If the allocator later hands the blocks to another tenant without isolating or clearing old contents, the later workload may recover residual bytes from a sandbox that no longer exists.

Vercel attributed this finding to an internal researcher and included it separately from the kernel networking disclosure and the snapshot metadata issue. The public account is evidence of a discovered defect, not proof of a named customer losing information. It does not specify the number or sensitivity of accessible bytes, the exact affected storage target, or independent verification of the remediation. These absences constrain claims about exploitation scale.

A correct tenant-isolation test must span deletion, reuse, abnormal shutdown and recovery. Restricting concurrent tenants' processes will not repair residual data in an allocator. Sanitization or per-tenant encryption must be validated against the actual block lifecycle, with old content made unrecoverable before reassignment.