What changed
Vercel Security Review is now in public beta for Pro and Enterprise teams. Once enabled, it runs when code is pushed to a connected GitHub repository, including direct and force pushes to a production branch. Findings are tied to the project, environment, branch and commit, with an AI-generated severity rating, a suggested fix and a record in the Vulnerabilities dashboard.
The review compares each push with a base revision and analyzes the changed code together with surrounding context. It can apply team- or project-level security policies written in natural language. Private and internal repositories receive a GitHub check, and pull requests can receive inline findings. A developer can ask Vercel Agent to validate a finding and open a fix pull request, but the change is not merged without approval.
This remains a source-code review rather than a security audit, runtime test or penetration test. Vercel says reviews are billed at the underlying model’s token price plus its $0.25-per-million-token Agent rate; review runs are free until 10 November 2026, while Agent-generated fixes are billed.
Our perspective
The important shift is the trigger. Security analysis becomes an event attached to every change, not a step that only happens when a team remembers to open a pull request. That is particularly useful when coding agents make frequent, small commits or when emergency changes bypass the normal review path.
But a diff-scoped AI review cannot establish that the whole application is safe. AI-generated severity also needs human validation. Teams should keep deterministic controls for dependencies, secrets, access policies, tests and production monitoring, then use agent review as an additional signal for logic flaws such as missing authorization or tenant isolation.
Before enabling it broadly, define a short security policy, assign finding ownership, require review of proposed fixes, and measure false positives, missed issues and cost per push. The practical goal is not more alerts; it is a faster, auditable route from a risky code change to a verified correction.
Go to the source
Primary reporting behind this brief. Our perspective is editorial analysis.
- Vercel — Security Review public beta 3 Nov 2026
- Vercel — Introducing Vercel Security Review 2 Nov 2026