Vercel binds login sessions to devices and opens AI security reviews
First merged summary.
Vercel is gradually rolling out device-bound session credentials and a public-beta AI security review for Pro and Enterprise teams.
Vercel is rolling out Device Bound Session Credentials that bind login sessions to a hardware-backed private key stored on the device. A stolen session cookie cannot be refreshed or reused elsewhere, and malware cannot retrieve the private key. Full support is limited to Chrome on Mac and Windows; a less secure polyfill is planned, and other devices fall back to standard login. Rollout is gradual to handle cases such as OAuth apps. Vercel Security Review, an AI code scanner in Vercel Agent, is in public beta for Pro and Enterprise teams and is free until November 10, 2026.
- Full DBSC support is limited to Chrome on Mac and Windows.
- Unsupported devices fall back to standard authentication without breaking login.
- The feature complements Chrome’s App-Bound Encryption.
- Security Review comments on GitHub pull requests and can propose a fix.
- Reviews are free for Pro and Enterprise teams until November 10, 2026.
- Vercel is also working on DPoP for its CLI.
Timeline
dated events in the reporting · oldest first- Nov 10, 2026Free Security Review scans end · BleepingComputer
What each outlet adds
beyond the shared facts- BleepingComputerTPM key storage, App-Bound Encryption, and missing authorization checks.
- Help Net SecurityChrome-only full support, planned polyfill, DPoP, and PR workflow.
Coverage
oldest first · one row per article · UTC- · 4d ago
BleepingComputerFirst report
Vercel rolls out protection against stolen session cookie attacks
Vercel binds logins to device TPM to prevent stolen cookie reuse
- · 4d ago
Help Net Security
Vercel ties sessions to devices and opens AI security reviews in beta
Full Device Bound Session Credentials support is limited to Chrome on Mac and Windows, with a less secure polyfill planned.