Vercel Security Review: vuln scans on every GitHub push (public beta)

Vercel launched Security Review in public beta (blog dated Nov 2, 2026; @vercel announced it Nov 3). It sits in Vercel Agent next to Code Review and Investigation. Once enabled, it scans for vulnerabilities on every push to a team's connected GitHub repositories.

What it does. Each review compares the push to a base (for deployments, the branch's previous deployment) and covers only what changed, so Vercel says reviews finish in seconds and can run on every preview and production deployment. Findings land in the Security dashboard and via CLI. On private and internal repos, Security Review also adds a GitHub check and comments on the pull request. On public repos, the docs say it posts only the check (with a link to the dashboard) so unpatched issues aren't disclosed publicly.

What it looks for. The agent reads the diff plus surrounding code, traces how the change can be reached, checks existing protections, and rechecks each finding before reporting. Vercel's pitch is catching logic flaws such as missing authorization checks that pattern-matching scanners miss. Teams can also write plain-language security policies (apply per project or team-wide) and manage them with vercel security policy.

Fixes. With permission, Fix with Vercel Agent in the dashboard validates the finding still exists, makes a minimal fix, and updates tests. Or pull findings with vercel security vulnerabilities and hand them to your own coding agent. Enterprise teams can send audit-log events for new findings to a SIEM via Audit Log Drains.

Who it's for: Pro and Enterprise teams already deploying from GitHub on Vercel, especially ones where agents push often and you want a default security pass on every change.

Pricing (from the blog). Reviews are free until November 10, 2026. After that, Security Review is billed at the Vercel Agent rate: model tokens at the provider rate with no markup, plus $0.25 per million tokens. Fixes made with Vercel Agent use the same rate. Docs: reviews run per Git push event (not per PR), so cost scales with how often you push and how much code changed.

Caveats, from Vercel. Public beta for Pro and Enterprise only. Trigger today is GitHub push (including direct pushes to production); Vercel says CLI/v0 deployments and repos that don't deploy on Vercel are next. It analyzes code, not a running app — not a security audit, and it doesn't do runtime or penetration testing. Findings can include source snippets (including sensitive data in those snippets). To fix with Vercel Agent you also need Enable Chat on in Agent settings. MODEL has not tested it.

Disclosure: MODEL's site is hosted on Vercel. Not sponsored. No affiliate links. Not investment advice.

MODEL Editors