# Vercel Security Review: Vercel Agent now scans every GitHub push for vulnerabilities (public beta)

Canonical: https://theagenticweekly.com/news/vercel-security-review-public-beta · Evidence: Reported · First seen: 2026-11-03 21:37 UTC · Source published: 2026-11-02 13:00 UTC · Brief published: 2026-11-03 22:06 UTC · Updated: 2026-11-03 22:06 UTC · Author: Agentic Weekly

> Vercel launched Security Review in public beta on November 2, 2026, a Vercel Agent feature that "scans for vulnerabilities on every push to a team's connected GitHub repositories". It is available to Pro and Enterprise teams, free until November 10, 2026, then billed at provider token rates plus $0.25 per million tokens.

## What changed

- Security Review joins Code Review and Investigation inside Vercel Agent. Once enabled, it runs on GitHub push events, including direct pushes to the production branch, and in monorepos it is scoped to the project's root directory.
- Each review scans only the diff against a base (for deployments, the branch's previous deployment), which Vercel says lets it finish in seconds on every preview and production deployment. It traces how changed code can be reached and rechecks findings, aiming at logic flaws such as missing authorization checks.
- Teams can write security policies in plain language and apply them per project or team-wide; policies can also be managed with the vercel security policy CLI command.
- Findings go to a Security dashboard and, on private and internal repos, to a GitHub check and pull request comment. Duplicates are suppressed, each finding is tied to the deployment where it first appeared, and Enterprise teams get audit log events for their SIEM.
- Fix with Vercel Agent confirms a finding still exists, makes the smallest fix and updates tests. Alternatively, vercel security vulnerabilities or a Markdown/JSON copy hands findings to your own coding agent.
- Public beta for Pro and Enterprise teams. Reviews are free until November 10, 2026, then billed at the Vercel Agent rate: model tokens at the provider's price with no markup, plus $0.25 per million tokens.

## In the source's words

> "Because it only scans the diff, Security Review finishes in seconds and can run on every preview and production deployment."
> (Vercel, "Introducing Vercel Security Review", https://vercel.com/blog/vercel-security-review)

> "with model tokens at the provider's rate and no markup, plus $0.25 per million tokens."
> (Vercel, "Introducing Vercel Security Review", https://vercel.com/blog/vercel-security-review)

> "Security reviews are free until November 10, 2026."
> (Vercel, "Introducing Vercel Security Review", https://vercel.com/blog/vercel-security-review)

## Early verdict

Most relevant to teams already deploying on Vercel whose code is increasingly written by agents: it adds diff-level security checks on every push with no setup beyond a toggle, but it is a beta with no published accuracy numbers. (Basis: Based on Vercel's announcement, which states the scope, beta status and pricing; we have not tested it.)

## What we have not verified

- We did not run Security Review; the speed claim and the ability to catch logic flaws that pattern-matching scanners miss are Vercel's own statements.
- The post does not publish detection or false-positive rates, or say which model the agent uses.
- We did not check how the $0.25 per million tokens fee compares in practice to a typical review's token count.

## Timeline

- Source published: 2026-11-02 13:00 UTC
- First seen by our watcher: 2026-11-03 21:37 UTC (via Vercel blog)
- Brief published: 2026-11-03 22:06 UTC

## Sources

- [Vercel blog: Introducing Vercel Security Review](https://vercel.com/blog/vercel-security-review) (primary source) (fetched 2026-11-03)

## Related

- [All news briefs](https://theagenticweekly.com/news)
- [This week's releases](https://theagenticweekly.com/this-week)
- [New AI models this week](https://theagenticweekly.com/models/this-week)

## How to cite

Agentic Weekly, "Vercel Security Review: Vercel Agent now scans every GitHub push for vulnerabilities (public beta)", published 2026-11-03 22:06 UTC, https://theagenticweekly.com/news/vercel-security-review-public-beta