The Pulse
Vercel Opens Automated Security Review to Pro and Enterprise Teams
Vercel Security Review is now in public beta for Pro and Enterprise teams, reviewing pushes to connected GitHub repositories and reporting findings in a dashboard. The source-code analysis includes suggested fixes and AI-generated severity
AI.info Team · Written with AI · fact-checked ·
Vercel has opened Security Review in public beta for Pro and Enterprise teams. Once enabled, the service automatically reviews every push to a connected GitHub repository and reports findings in the Vulnerabilities dashboard. Reviews are triggered by GitHub push events, rather than by pull requests, so the process also covers direct and force pushes to a production branch.
GitHub pushes trigger each review
Security Review starts when code is pushed to a connected repository. If a single push affects more than one project, Vercel reviews every affected project together. This means a review can run whether a change arrives through a pull request or is pushed directly to a branch, including the production branch.
Each finding records the project, environment, branch and commit associated with the issue. It includes a summary, a suggested fix and an AI-generated severity rating. The recorded project and code details help identify where the finding applies, while the suggested fix and rating provide information for teams reviewing the report.
Findings appear in checks and pull requests
Security Review adds its own GitHub check to each commit it reviews. When a pull request is present, the service also posts findings as review comments, with links back to the individual findings. On public repositories, finding details remain in the Vercel dashboard.
Teams can hand a vulnerability report to Vercel Agent by selecting “Fix with Vercel Agent.” The agent proposes a fix and opens a pull request for the team to review. The change is not merged until it is approved. Teams that want to use a coding agent instead can access findings with the vercel security vulnerabilities command in the Vercel CLI, or copy a finding in Markdown or JSON format.
Policies add project-specific context
Teams can write security policies in plain language to give Security Review more context about how they build. A policy can apply to all projects or to specific projects. Teams set a team-wide policy in Agent settings and a project-specific policy in that project’s Security settings.
The Vercel CLI command requires version 65.10.0 or later. The Markdown and JSON options provide another way to take finding details out of the dashboard for use with a team’s coding agent.
Source-code checks, not a security audit
Security Review analyzes source code. Vercel says it is not a security audit and does not perform runtime or penetration testing. The company also cautions that the service helps teams find vulnerabilities but does not guarantee an application is free of them.
Reviews are free until November 10, 2026. Vercel says Security Review is billed at the Vercel Agent rate: provider inference at the underlying token rate with no markup, plus the Vercel Token Rate of $0.25 per million tokens. That token total counts input, cached and output tokens. Because reviews run on each GitHub push, costs scale with how often a team pushes and how much code changes.
Teams can enable Security Review in their Agent settings. Vercel also points users to its documentation and announcement for more information about the feature.