Vercel puts security review on every push: direct pushes to production get checked, and fixes wait for your approval
Synopsis
Vercel Security Review is in public beta for Pro and Enterprise teams: once enabled, every push to a connected GitHub repository is automatically reviewed for vulnerabilities, with findings reported in the Vulnerabilities dashboard. Reviews start from push events rather than pull requests, so direct and force pushes to the production branch are reviewed too, and every project affected by one push is reviewed together. Each finding records the project, environment, branch and commit with a summary, a suggested fix and an AI-generated severity rating; Fix with Vercel Agent has the agent propose a fix and open a pull request that nothing merges until you approve.
Interpretation
Vercel Security Review opens in public beta to Pro and Enterprise teams; once enabled, every push to a connected GitHub repository is automatically reviewed for vulnerabilities, and findings are reported in the Vulnerabilities dashboard. Reviews start from push events rather than pull requests, so direct and force pushes to the production branch are reviewed as well, and every project affected by a single push is reviewed together. Each finding records the project, environment, branch and commit, with a summary, a suggested fix and an AI-generated severity rating, so a result can be traced to a specific commit.
Clicking Fix with Vercel Agent hands a finding to Vercel Agent, which proposes a fix and opens a pull request for review, and nothing merges until the user approves it. Teams can instead fix findings with their own coding agent through the vercel security vulnerabilities command in the Vercel CLI, or copy any finding as Markdown or JSON. Security Review adds its own GitHub check to each commit it reviews, and when there is a pull request it posts findings as review comments linking back to each finding; on public repositories, finding details stay in the dashboard.
Teams can write security policies in plain language, for all projects or specific ones, to give Security Review more context about how they build. A team policy is set in Agent settings and a project policy in the project's Security settings. Security Review analyzes source code; it is not a security audit and does not perform runtime or penetration testing, so it helps find vulnerabilities but does not guarantee an application is free of them.
Perspective
It targets Pro and Enterprise teams, reviews connected GitHub repositories, and analyzes source code; teams enable it in Agent settings, and the CLI command needs Vercel CLI 65.10.0 or later.
Security Review is not a security audit and does not perform runtime or penetration testing; it helps find vulnerabilities but does not guarantee an application is free of them. Security reviews are free until November 10, 2026, after which they are billed at the Vercel Agent rate.