Vercel rolls out Device Bound Session Credentials to stop cookie thefts

Cloud platform Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its infrastructure to serve as a primary defense against information-stealing malware.

The update specifically targets logins at vercel.com, where developers manage their web deployments, projects, and cloud environments.

• Vercel is deploying Device Bound Session Credentials to fight session hijacking.
• Private encryption keys cannot be retrieved by Vercel or any malware.
• DBSC currently operates on Chrome for macOS and Windows during the rollout phase.
• A similar protection named DPoP is being implemented for the Vercel CLI.

How DBSC protects developer accounts

Device Bound Session Credentials work by cryptographically binding a user session to a specific physical device. The mechanism relies on generating a key pair where the private key remains securely stored on the local machine.

Vercel notes that the private key can never be retrieved again by the platform or by malware. The rollout is currently taking place gradually in Chrome on macOS and Windows to safely handle edge cases involving OAuth applications.

Additional security updates and Security Review

Alongside DBSC, Vercel is introducing a complementary security technology called DPoP (Demonstrating Proof-of-Possession) specifically designed for the Vercel CLI utility.

Furthermore, Vercel launched the public beta of Security Review for Pro and Enterprise teams earlier this week. The feature integrates into Vercel Agent to scan code changes on every push to connected GitHub repositories.

Context and business impact

The automated system uses code and team-defined policies to flag issues like missing authorization checks and exposed secrets. If granted appropriate permissions, Vercel Agent can validate and commit code fixes automatically.

Vercel announced that Security Review scans will be free until November 10, 2026, while agent-generated fixes will be billed separately. These additions reinforce platform security following past incidents and protect developer workflows.