Vercel ties sessions to devices and opens AI security reviews in beta
Original title: Vercel ties login sessions to devices, rolls out AI security reviews in public beta
Full Device Bound Session Credentials support is limited to Chrome on Mac and Windows, with a less secure polyfill planned.
Vercel is rolling out Device Bound Session Credentials so a stolen session cookie cannot be refreshed without a hardware-backed private key on the device that created the session. It is also opening Vercel Security Review, an AI code scanner in Vercel Agent, to Pro and Enterprise teams in public beta. Reviews run on GitHub pushes, comment on pull requests, and can propose a minimal fix. Security Review is free until November 10, 2026.
- Unsupported devices fall back to standard authentication without breaking login.
- Vercel is rolling DBSC out slowly because of special cases such as OAuth apps.
- The company is also working on DPoP for its CLI.
- The scanner checks code changed since the branch’s previous deployment.
- Users can send a finding to their own coding agent.
From the original article
2 min read at helpnetsecurity.com
Vercel, the popular cloud platform for building and hosting websites and web applications, has announced the rollout of Device Bound Session Credentials (DBSC) and the launch of Vercel Security Review in public beta.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.