Vercel ties login sessions to devices, rolls out AI security reviews in public beta
Vercel, the popular cloud platform for building and hosting websites and web applications, has announced the rollout of Device Bound Session Credentials (DBSC) and the launch of Vercel Security Review in public beta.
Vercel, the popular cloud platform for building and hosting websites and web applications, has announced the rollout of Device Bound Session Credentials (DBSC) and the launch of Vercel Security Review in public beta.
Device Bound Session Credentials is a security technology designed to limit the consequences of an infostealer infection and to thwart attackers’ session hijacking attempts.
DBSC effectively ties a login session to the device it was created on.
Vercel is rolling out DBSC slowly, because the technology is new, still not widespread, and Ubl added.
It scans the code that changed since the branch’s previous deployment, reads the surrounding code, traces how the changed code can be reached, and checks for existing protections before reporting anything.
The browser generates a public/private key pair, and the private key is stored in secure hardware on the device (such as a TPM or Secure Enclave) so it cannot be exported.
This week, Vercel also opened up Vercel Security Review to Pro and Enterprise teams.
Users can have Vercel Agent verify a finding and commit a minimal fix, including updated tests, or pass the details to their own coding agent.
He said Vercel is also working on shipping a related technology – Demonstrating Proof-of-Possession (DPoP) – for its command-line interface (CLI).
Part of Vercel Agent, the offering is an AI code scanner that checks users’ code for security vulnerabilities every time they push to GitHub.
What happened
Vercel, the popular cloud platform for building and hosting websites and web applications, has announced the rollout of Device Bound Session Credentials (DBSC) and the launch of Vercel Security Review in public beta.
Device Bound Session Credentials is a security technology designed to limit the consequences of an infostealer infection and to thwart attackers’ session hijacking attempts.
DBSC effectively ties a login session to the device it was created on.
What changed
Vercel is rolling out DBSC slowly, because the technology is new, still not widespread, and Ubl added.
It scans the code that changed since the branch’s previous deployment, reads the surrounding code, traces how the changed code can be reached, and checks for existing protections before reporting anything.
Who is affected
The browser generates a public/private key pair, and the private key is stored in secure hardware on the device (such as a TPM or Secure Enclave) so it cannot be exported.
This week, Vercel also opened up Vercel Security Review to Pro and Enterprise teams.
Why it matters
Users can have Vercel Agent verify a finding and commit a minimal fix, including updated tests, or pass the details to their own coding agent.
Technical details
He said Vercel is also working on shipping a related technology – Demonstrating Proof-of-Possession (DPoP) – for its command-line interface (CLI).
Part of Vercel Agent, the offering is an AI code scanner that checks users’ code for security vulnerabilities every time they push to GitHub.
Attribution
Help Net Security: Vercel, the popular cloud platform for building and hosting websites and web applications, has announced the rollout of Device Bound Session Credentials (DBSC) and the launch of Vercel Security Review in public beta.
What to watch next
Watch for revised vendor guidance, fixed versions and mitigation updates.