Vercel is gradually rolling out Device Bound Session Credentials (DBSC) to protect developer accounts from information-stealing malware. The technology binds a Vercel login session to a specific device using a private key stored in its trusted platform module (TPM), preventing attackers from reusing a stolen session cookie on another device.
Vercel is a cloud platform for deploying and hosting websites, web applications, and AI agents. The company also develops the Next.js web framework.
Vercel binds sessions to device hardware
The new protection applies to logins to Vercel.com, where developers manage their projects and deployments. Vercel CTO Malte Ubl announced the rollout on X.
“DBSC works by storing a private key in your device’s TPM (the same device used by fingerprint sensors and similar biometric devices on laptops and mobile phones) and using that key to sign cookies,” Ubl explained.
“The private key can never be retrieved again. Not by us, not by you, not by malware.”
DBSC complements Chrome’s app-bound encryption, which makes it more difficult for information-stealing malware to extract browser cookies. While Chrome’s protection helps secure cookies in the browser, DBSC adds another layer by ensuring that a stolen session cookie cannot be used from a different device.
DBSC currently works in Chrome on macOS and Windows. Vercel is introducing it gradually to address edge cases involving OAuth applications.
Vercel is also rolling out similar protection, called DPoP, for the Vercel CLI.
Vercel introduces Security Review
Earlier this week, Vercel placed Security Review into public beta for professional and enterprise teams. Once enabled, Vercel Agent scans code changes on every push to connected GitHub repositories.
The system uses code and team-defined policies to identify issues including missing authorization checks and exposed secrets. If the required permissions are granted, Vercel Agent can validate and commit fixes.
Source: Vercel
According to Vercel, Security Review scans are free until November 10, 2026. Agent-generated fixes will be charged separately.
Ubl said Vercel’s security team had deployed the feature internally several months earlier. After seeing its value, the company decided to make it broadly available on the platform.
Rollout follows earlier Vercel breach
In April, Vercel disclosed a security breach affecting some customers. Attackers compromised employees’ Google Workspace accounts on Context.ai, then used that access to reach internal systems and view environment variables that had not been marked as sensitive.
Attackers impersonating ShinyHunters also attempted to sell allegedly stolen source code, access keys, and database data.
Source: www.bleepingcomputer.com