Vercel launches Security Review, an agent that scans every GitHub push for vulnerabilities

Archive entry: this covers an event from November 2, 2026, and we published it on November 8, 2026. The details come from sources dated at the time and may have changed since.

On November 2, 2026, Vercel introduced Security Review in public beta for Pro and Enterprise teams, as described in Vercel's announcement blog post. It was a Vercel Agent capability, alongside Code Review and Investigation, that scanned pushes to connected GitHub repositories for vulnerabilities.

What Security Review did

• Once enabled, it scanned every push to a connected GitHub repository, including direct pushes to the production branch, and each review covered only the changed code.
• A finding recorded the project, environment, branch and commit, with a summary, a suggested fix and an AI-generated severity.
• Findings appeared in the dashboard and, on private and internal repositories, as GitHub checks and PR comments.
• Fix with Vercel Agent proposed a fix and opened a pull request for review, and findings were also available through the vercel security vulnerabilities CLI command or as Markdown or JSON.
• Teams could write security policies in plain language, for all projects or for specific ones.

What it meant for people building with AI

As agents wrote more of the code that shipped, platforms were adding automated security review by default. Security Review scanned every push, including direct pushes to the production branch, and its suggested fixes came as pull requests for review.

Limits, pricing and next steps

Vercel said Security Review analyzed source code only, was not a security audit and did no runtime or penetration testing. It was billed at the Vercel Agent rate, which was provider inference at cost plus $0.25 per million tokens, and reviews were free until November 10, 2026. Vercel planned to extend it to deployments from the Vercel CLI and v0, and to repositories that do not deploy on Vercel. The Vercel changelog entry for the public beta is dated November 3, 2026.

Sources

• Introducing Vercel Security Review (Vercel, November 2, 2026, official)
• Vercel Security Review now in public beta (Vercel, November 3, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.