Introducing Vercel Security Review

Vercel is launching Vercel Security Review in public beta, a new capability in Vercel Agent that scans for vulnerabilities on every push to a team's connected GitHub repositories.

• The company says frontier AI models are making vulnerabilities far easier to find and exploit, and that agents are writing more of the code teams ship while each handles security review its own way, or not at all.
• Once enabled, Security Review scans changed code for flaws such as missing authorization checks or exposed secrets, and findings appear as pull request comments, in the Security dashboard, and via CLI.
• Each review compares the push against a base and covers only what changed, so it finishes in seconds and can run on every preview and production deployment.
• The agent reads the diff with surrounding code, traces how changed code can be reached, checks existing protections, and rechecks each finding before reporting it, which Vercel says catches logic flaws that pattern-matching scanners miss.
• Teams can write security policies in plain language and apply them to specific projects or across the team, and manage them with the Vercel CLI.
• Findings are deduplicated against previously reported issues and tied to the deployment where they first appeared, so a vulnerable change merged into production is flagged there too.
• Vercel Agent can validate and commit the smallest fix, and findings can also be pulled through the CLI for use with a team's own coding agent.