Vercel Security Review is now in public beta for Pro and Enterprise teams. Once enabled, every push to a connected GitHub repository is automatically reviewed for vulnerabilities, and findings are reported in the Vulnerabilities dashboard.
Security Review runs automatically when code is pushed to a connected GitHub repository. Because reviews start from push events rather than pull requests, direct and force pushes to your production branch are reviewed as well. Every project affected by a single push is reviewed together.
Each finding records the project, environment, branch, and commit, with a summary, a suggested fix, and an AI-generated severity rating.
Security Review adds its own GitHub check to each commit it reviews. When there's a pull request, it also posts findings as review comments that link back to each finding. On public repositories, finding details stay in the dashboard.
Clicking Fix with Vercel Agent on a vulnerability report hands the finding to Vercel Agent, which proposes a fix and opens a pull request for you to review. Nothing merges until you approve it.
To fix findings with your coding agent instead, use vercel security vulnerabilities in the Vercel CLI, or copy any finding as Markdown or JSON.
Teams can write security policies in plain language, for all projects or specific ones, to give Security Review more context about how they build. Set a team policy in Agent settings and a project policy in the project's Security settings.
Security Review analyzes source code. It isn't a security audit, and it doesn't perform runtime or penetration testing. It helps you find vulnerabilities but doesn't guarantee your application is free of them.
Security Review is billed at the Vercel Agent rate: provider inference at the underlying token rate with no markup, plus the Vercel Token Rate of $0.25 per million tokens (input, cached, output). Reviews run on each push to GitHub, so cost scales with how often you push and how much code changes.
Security reviews are free until November 10, 2026, and fixes made with Vercel Agent are billed at the Vercel Agent rate.
Enable Security Review in your team’s Agent settings, or read the documentation and the announcement to learn more. The CLI command needs Vercel CLI 65.10.0 or later.