Vercel rolls out new protection against stolen session cookie attacks

What it is

Vercel is gradually rolling out Device Bound Session Credentials (DBSC) for logins to vercel.com, announced by CTO Malte Ubl on X. Vercel is also rolling out DPoP, a similar technology, for the Vercel CLI. The article adds Security Review, a Vercel Agent feature that entered public beta earlier in the same week.

How it works

DBSC stores a private key in the device TPM and uses it to sign the session cookie. Ubl says the key cannot be retrieved by Vercel, the user or malware. A cookie taken by an infostealer therefore cannot be replayed from another device. The page says DBSC complements Chrome's App-Bound Encryption, which makes cookie extraction harder in the first place.

Preconditions / Affected

• DBSC works in Chrome on macOS and Windows only, per the page.
• The rollout is gradual so that edge cases involving OAuth apps can be handled. The page does not describe those cases.
• Security Review is available to Pro and Enterprise teams. It scans code changes on every push to connected GitHub repositories once enabled.

What to do

• Security Review scans are free until 10 November 2026. Agent-generated fixes are billed separately. Teams on Pro or Enterprise who want to try it without scan charges have a short window.
• Security Review checks code against code and team-defined policies. Examples named are missing authorization checks and exposed secrets. If permissions allow, Vercel Agent can validate and commit fixes.
• The page gives no setup steps, settings names or commands for DBSC, DPoP or Security Review.

Caveats

• The April 2026 breach began with a compromised employee Google Workspace account at Context.ai. The attacker reached internal systems and viewed environment variables that had not been marked as sensitive. DBSC addresses stolen session cookies. The page does not say it would have prevented that incident.
• A threat actor impersonating ShinyHunters tried to sell allegedly stolen source code, access keys and database data. The page does not confirm the claim.
• Ubl says Vercel's security team used Security Review internally for a couple of months before release. The page gives no detection rates or benchmarks.