Reported News
Vercel Security Review: Vercel Agent now scans every GitHub push for vulnerabilities (public beta)
Vercel launched Security Review in public beta on November 2, 2026, a Vercel Agent feature that "scans for vulnerabilities on every push to a team's connected GitHub repositories". It is available to Pro and Enterprise teams, free until November 10, 2026, then billed at provider token rates plus $0.25 per million tokens.
- Changes reported
- 6
- listed below, each from a source we read
- We tested
- Not tested yet
- reported from sources; we did not run it ourselves
- Gaps we flag
- 3
- things we could not verify
- Sources
- 1
- 1 primary, linked below
What changed
| # | What the source says | Status |
|---|---|---|
| 01 | Security Review joins Code Review and Investigation inside Vercel Agent. Once enabled, it runs on GitHub push events, including direct pushes to the production branch, and in monorepos it is scoped to the project's root directory. | Reported |
| 02 | Each review scans only the diff against a base (for deployments, the branch's previous deployment), which Vercel says lets it finish in seconds on every preview and production deployment. It traces how changed code can be reached and rechecks findings, aiming at logic flaws such as missing authorization checks. | Reported |
| 03 | Teams can write security policies in plain language and apply them per project or team-wide; policies can also be managed with the vercel security policy CLI command. | Reported |
| 04 | Findings go to a Security dashboard and, on private and internal repos, to a GitHub check and pull request comment. Duplicates are suppressed, each finding is tied to the deployment where it first appeared, and Enterprise teams get audit log events for their SIEM. | Reported |
| 05 | Fix with Vercel Agent confirms a finding still exists, makes the smallest fix and updates tests. Alternatively, vercel security vulnerabilities or a Markdown/JSON copy hands findings to your own coding agent. | Reported |
| 06 | Public beta for Pro and Enterprise teams. Reviews are free until November 10, 2026, then billed at the Vercel Agent rate: model tokens at the provider's price with no markup, plus $0.25 per million tokens. | Reported |
reported by the sourcemeasured or run by usnot verified
Primary source: Vercel blog: Introducing Vercel Security Review. We are the fast, independent index; the vendor’s own page is the source of record for this release.
In the source’s words
“Because it only scans the diff, Security Review finishes in seconds and can run on every preview and production deployment.”
“with model tokens at the provider's rate and no markup, plus $0.25 per million tokens.”
“Security reviews are free until November 10, 2026.”
Early verdict
Most relevant to teams already deploying on Vercel whose code is increasingly written by agents: it adds diff-level security checks on every push with no setup beyond a toggle, but it is a beta with no published accuracy numbers.
Basis: Based on Vercel's announcement, which states the scope, beta status and pricing; we have not tested it.
What we have not verified
- We did not run Security Review; the speed claim and the ability to catch logic flaws that pattern-matching scanners miss are Vercel's own statements.
- The post does not publish detection or false-positive rates, or say which model the agent uses.
- We did not check how the $0.25 per million tokens fee compares in practice to a typical review's token count.
This brief is Reported: written from the sources below, not from running the release ourselves.
Sources
- Vercel blog: Introducing Vercel Security Reviewprimary source · fetched 2026-11-03
Related
Spotted an error? See our corrections policy or email the address on the contact page. Markdown version for agents: /news/vercel-security-review-public-beta.md
Want these briefs in your Google Top Stories? Add Agentic Weekly as a preferred source on Google.
Newsletter
The Weekly Verdict. Free, every Monday.
A free email every Monday: the week's few big AI releases, then 5 short use cases for the new models, each with a prompt you can paste.
Free. Double opt-in. One click to unsubscribe.