Vercel has begun a phased deployment of Device Bound Session Credentials (DBSC) across its platform, introducing a defense mechanism against information stealer malware. The technology, revealed by Vercel CTO Malte Ubl via social media, anchors each user session to their specific device by storing a private key in the device's TPM, rendering stolen session cookies unusable if transferred to another machine.
Vercel operates as a deployment and hosting platform for developers building websites, web applications, and AI agents. The company also maintains the widely-used Next.js framework. The DBSC rollout applies to logins at vercel.com, where developers oversee their projects and deployments.
According to Ubl, "DBSC works by storing a private key in your device's TPM (the same device that the fingerprint sensor or similar biometric devices on your laptop or phone uses) and using that key to sign your cookie." He further noted that "The private key can never be retrieved ever again. Not by us, not by you, not by the malware."
The DBSC implementation complements Chrome's App-Bound Encryption, which restricts infostealer malware's ability to extract browser cookies. By preventing stolen credentials from functioning on different devices, DBSC introduces an additional protective layer. Currently, the feature operates on Chrome across macOS and Windows systems, with a gradual rollout underway to properly address edge cases involving OAuth applications.
In parallel, Vercel is deploying a related protective mechanism called DPoP for the Vercel CLI.
Security Review enters public beta
This week, Vercel introduced Security Review in public beta, making the feature available to Pro and Enterprise teams. The addition to Vercel Agent automatically scans code modifications pushed to connected GitHub repositories when activated.
The system leverages code analysis and team-specified policies to identify problems including missing authorization checks and exposed secrets. When permissions are configured appropriately, Vercel Agent can validate and apply fixes automatically.
Vercel has announced that Security Review scans will carry no charge through November 10, 2026, though fixes generated by the agent will incur separate billing. Ubl indicated that Vercel's internal security team deployed this capability several months ago and observed measurable benefits, prompting the decision to expand access to the broader user base.
The security enhancements arrive following a breach in April that compromised a portion of Vercel's customer base. Attackers penetrated Vercel's infrastructure by taking over an employee's Google Workspace account at Context.ai, then leveraged that access to reach internal systems and retrieve environment variables that lacked sensitive designation. A threat actor using the ShinyHunters alias subsequently attempted to auction the allegedly obtained source code, access credentials, and database records.