Vercel ties login sessions to devices, rolls out AI security reviews in public beta
Vercel, the popular cloud platform for building and hosting websites and web applications, has announced the rollout of Device Bound Session Credentials (DBSC) and the launch of Vercel Security Review in public beta.
Making stolen session cookies worthless
Device Bound Session Credentials is a security technology designed to limit the consequences of an infostealer infection and to thwart attackers’ session hijacking attempts.
Aside from stealing authentication credentials, modern info-stealing malware such as Lumma, RedLine, and Vidar can also steal browser cookies. Session cookies are especially valuable because they are issued after login, including after multi-factor authentication. An attacker who replays one (in a so-called “pass-the-cookie” attack) can get into an account without the password or the second factor.
DBSC effectively ties a login session to the device it was created on. The browser generates a public/private key pair, and the private key is stored in secure hardware on the device (such as a TPM or Secure Enclave) so it cannot be exported.
The server then issues short-lived cookies that the browser has to keep refreshing by proving it holds the private key. So even if a cookie is stolen, it expires quickly, and without the key the attacker can’t refresh it.
“If a user’s device does not support secure key storage, DBSC gracefully falls back to standard behavior without breaking the authentication flow,” says Google.
“DBSC is currently only supported by Chrome on Mac and Windows. We are also working on a kind of polyfill for other browsers. However, the polyfill is less secure and we would love to see broader browser adoption,” Vercel CTO Malte Ubl explained on Tuesday.
Vercel is rolling out DBSC slowly, because the technology is new, still not widespread, and “in our case there were lots of special cases for things like [OAuth] apps that we needed to resolve,” Ubl added.
He said Vercel is also working on shipping a related technology – Demonstrating Proof-of-Possession (DPoP) – for its command-line interface (CLI).
Vercel Agent now checks code for security flaws
This week, Vercel also opened up Vercel Security Review to Pro and Enterprise teams.
Part of Vercel Agent, the offering is an AI code scanner that checks users’ code for security vulnerabilities every time they push to GitHub.
It scans the code that changed since the branch’s previous deployment, reads the surrounding code, traces how the changed code can be reached, and checks for existing protections before reporting anything.
Findings appear as comments on pull requests, are listed in the Security dashboard, and are available via CLI.
Security reviews are triggered by GitHub push events. (Source: Vercel)
“Every finding explains the vulnerability and how to fix it, with links to the commit and deployment where it first appeared,” Vercel explained.
Users can have Vercel Agent verify a finding and commit a minimal fix, including updated tests, or pass the details to their own coding agent.
Use of Security Review is free until November 10, 2026.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
