a pretty big design flaw is how vercel handles github and gitlab submodules:
the github_token just in public display for everyone to see if the repo is open.
one workaround is to create a custom script to replace the token previous to the build using vercel's env vars. another workaround is to put gitmodules as a secret in vercel and write it to the file during prebuild.
surprisingly, this has been already marked as an issue in 2020 (5 years ago!) and there's still no support for private git submodules.
what i'll be doing is simply... cloning the repo prebuild time.