# Vercel — Introducing Vercel Security Review

- Company: Vercel (vercel.com)
- Announced: 2026-11-02T13:00:00+00:00
- Category: capability-change
- Coverage: not counted
- Announcement: yes
- Group: announcements
- Source: https://vercel.com/blog/vercel-security-review
- Record: https://forck.live/items/31243-introducing-vercel-security-review
- Subject: v0 / AI SDK / AI Gateway

Vercel is launching Vercel Security Review in public beta, a new capability in Vercel Agent that scans for vulnerabilities on every push to a team's connected GitHub repositories. The company says frontier AI models are making vulnerabilities far easier to find and exploit, and that agents are writing more of the code teams ship while each handles security review its own way, or not at all. Once enabled, Security Review scans changed code for flaws such as missing authorization checks or exposed secrets, and findings appear as pull request comments, in the Security dashboard, and via CLI. Each review compares the push against a base and covers only what changed, so it finishes in seconds and can run on every preview and production deployment. The agent reads the diff with surrounding code, traces how changed code can be reached, checks existing protections, and rechecks each finding before reporting it, which Vercel says catches logic flaws that pattern-matching scanners miss. Teams can write security policies in plain language and apply them to specific projects or across the team, and manage them with the Vercel CLI. Findings are deduplicated against previously reported issues and tied to the deployment where they first appeared, so a vulnerable change merged into production is flagged there too. Vercel Agent can validate and commit the smallest fix, and findings can also be pulled through the CLI for use with a team's own coding agent. Security Review is available today in public beta for Pro and Enterprise teams, and Vercel says it is next bringing it to deployments from the Vercel CLI and v0 and to repositories that don't deploy on Vercel.

## Evidence

Verbatim from https://vercel.com/blog/vercel-security-review:

> Today, we are launching Vercel Security Review in public beta.
> 
> Security Review is a new capability in Vercel Agent , alongside Code Review and Investigation. Once enabled, it scans for vulnerabilities on every push to a team's connected GitHub repositories.
> 
> Findings appear as comments on pull requests, are listed in the Security dashboard, and are available via CLI. With your permission, Vercel Agent can also validate and push fixes for findings.
> 
> Copy link to heading How it works
> 
> Security reviews are triggered by GitHub push events, including direct pushes to your production branch. In monorepos, reviews are scoped to the project's root directory. Here is how it works:
> 
> You push code to a GitHub repository connected to a Vercel project.
> 
> As soon as the push lands, Security Review scans the changed code for vulnerabilities like missing authorization checks or exposed secrets.
> 
> Findings are posted to the Security dashboard. On private and internal repositories, Security Review also adds a GitHub check to the commit and comments on the pull request.

---

Record: https://forck.live/items/31243-introducing-vercel-security-review
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md