Vercel Security Review now in public beta

Vercel released Security Review in public beta for Pro and Enterprise teams, automatically scanning every push to a connected GitHub repository for vulnerabilities and reporting findings in a Vulnerabilities dashboard. Each finding records the project, environment, branch and commit with a summary, suggested fix and AI-generated severity rating, and clicking "Fix with Vercel Agent" opens a pull request that nothing merges until approved. Security reviews are free until November 10, 2026, after which they bill at the Vercel Agent rate — provider inference at the underlying token rate with no markup plus a $0.25 per million token Vercel Token Rate — and the CLI command `vercel security vulnerabilities` requires Vercel CLI 65.10.0 or later.

Vercel Security Review https://vercel.com/docs/agent/security-review is now in public beta for Pro and Enterprise teams. Once enabled, every push to a connected GitHub repository is automatically reviewed for vulnerabilities, and findings are reported in the Vulnerabilities dashboard https://vercel.com/d?to=%2F%5Bteam%5D%2F~%2Fsecurity%2Fvulnerabilities . Security Review runs automatically when code is pushed to a connected GitHub repository. Because reviews start from push events rather than pull requests, direct and force pushes to your production branch are reviewed as well. Every project affected by a single push is reviewed together. Each finding records the project, environment, branch, and commit, with a summary, a suggested fix, and an AI-generated severity rating. Security Review adds its own GitHub check to each commit it reviews. When there's a pull request, it also posts findings as review comments that link back to each finding. On public repositories, finding details stay in the dashboard. Clicking Fix with Vercel Agent on a vulnerability report hands the finding to Vercel Agent, which proposes a fix and opens a pull request for you to review. Nothing merges until you approve it. To fix findings with your coding agent instead, use vercel security vulnerabilities in the Vercel CLI, or copy any finding as Markdown or JSON. Teams can write security policies in plain language, for all projects or specific ones, to give Security Review more context about how they build. Set a team policy in Agent settings and a project policy in the project's Security settings. Security Review analyzes source code. It isn't a security audit, and it doesn't perform runtime or penetration testing. It helps you find vulnerabilities but doesn't guarantee your application is free of them. Security Review is billed at the Vercel Agent rate https://vercel.com/docs/agent/pricing : provider inference at the underlying token rate with no markup, plus the Vercel Token Rate of $0.25 per million tokens input, cached, output . Reviews run on each push to GitHub, so cost scales with how often you push and how much code changes. Security reviews are free until November 10, 2026, and fixes made with Vercel Agent are billed at the Vercel Agent rate. Enable Security Review in your team’s Agent settings https://vercel.com/d?to=%2F%5Bteam%5D%2F~%2Fsettings%2Fagent , or read the documentation https://vercel.com/docs/agent/security-review and the announcement https://vercel.com/blog/vercel-security-review to learn more. The CLI command needs Vercel CLI 65.10.0 or later.