Vercel puts Security Review on every push: diff-only scans finish in seconds and the agent can push fixes

Vercel has wired vulnerability scanning into the code-hosting routine: once a team enables Security Review in Vercel Agent settings, every push to a connected GitHub repository triggers a review, and findings are written into pull request comments, the security dashboard and the command line. The situation it addresses is that agents write more of the code teams ship, each handling security review its own way or, in many cases, not at all, while pattern-matching scanners do not catch logic flaws such as missing authorization checks. Vercel's demonstration is a fictional invoice download endpoint whose lookup takes the invoice ID without checking which organization owns it; the review flags within seconds that any signed-in user could download another organization's invoice by changing the ID.

A review takes the diff rather than the whole repository: it compares the push against a base, which for deployments is the branch's previous deployment, the version already running, so a review finishes in seconds and can run on every preview and production deployment. Vercel Agent does the judging: it reads the changed code with its surroundings, traces whether that code can be reached from outside, checks for existing protections, applies policies the team writes in plain language, and rechecks each finding before reporting it; for fixable findings it first confirms the vulnerability still exists, then makes the smallest change and updates the tests. Reviews are triggered by GitHub push events, including direct pushes to the production branch; in monorepos they are scoped to the project's root directory; and each finding stays tied to the deployment where it first appeared, so a vulnerable change merged into the production branch is flagged in production as well.

Security Review is in public beta for Pro and Enterprise teams and covers code pushed to GitHub repositories, with findings surfaced in pull request comments, the security dashboard and the CLI; agent fixes are offered for the findings the agent can fix. Vercel says it will next bring the review to deployments from the Vercel CLI and v0 and to repositories that do not deploy on Vercel, and let suggested fixes be applied directly from the pull request.

On billing, Security Review is charged at the Vercel Agent rate, with model tokens at the provider's rate and no markup, plus $0.25 per million tokens; the reviews themselves are free until November 10, 2026, and fixes made with Vercel Agent are billed at that same rate. The launch motivates the feature with frontier models making vulnerabilities easier to find and exploit, citing researchers who turned two decade-old flaws in PHP core into working remote code execution exploits; that is a statement of motive, not a measurement of what the review detects.