Vercel Security Review Enters Public Beta: Vulnerability Review on Every GitHub Push, One-Click Fixes with Vercel Agent

Background and pain point

More code is written by agents, and each agent handles security review differently, often not at all. Vercel's blog notes that frontier models make vulnerabilities easier to find and exploit, citing researchers who last month turned two decade-old PHP core flaws into working remote code execution exploits with relatively little effort. Security Review makes vulnerability review the default on every push rather than a one-off manual check before release.

How it works

Reviews are triggered by GitHub push events and compare each push against a base, covering only what changed; for deployments the base is the branch's previous deployment, so changes are checked against what is already running. The agent reads the diff and surrounding code, traces how the changed code can be reached, checks existing protections, and rechecks each finding before reporting it. Findings are deduplicated, tied to the deployment where they first appeared, and flagged in production once a vulnerable PR is merged. When a later review no longer detects an issue, it is marked as no longer detected and the GitHub comment is closed. Private and internal repos also get a GitHub check and PR comments.

Benchmarks

Vercel has not published detection rates, false-positive rates, or comparisons with tools such as Semgrep or CodeQL. What can be verified is the mechanism and pricing: model tokens at provider cost with no markup plus $0.25 per million tokens, with reviews free until November 10. Teams should validate results on their own repos.

Getting started

Pro and Enterprise teams enable Security Review in Vercel Agent Settings for all or selected projects. Findings appear in the Vulnerability view of the Security dashboard; clicking Fix with Vercel Agent makes the agent confirm the issue still exists, apply the smallest fix and update tests. You can also run vercel security vulnerabilities or copy findings as Markdown or JSON for your own agent, such as Claude Code or Codex. Start with a few projects and write team rules with vercel security policy, for example requiring endpoints that return customer data to check ownership. Vercel plans to extend it to Vercel CLI and v0 deployments and to repos that do not deploy on Vercel.