Vercel Security Review no longer requires a linked project

Vercel removed the requirement to link a GitHub repository before its AI-driven Security Review agent can scan it, auto-enabling vulnerability scans on every push for all unlinked repositories accessible to the Vercel GitHub App.

Vercel announced on November 13, 2026 that its Security Review agent no longer requires a GitHub repository to be linked to a Vercel project before it can scan the code, according to the Vercel changelog. The AI-driven scanner is now auto-enabled for every unlinked repository that the Vercel GitHub App can access.

What changed

Security Review can scan GitHub repositories for vulnerabilities without those repos being linked to a Vercel project
The scanner is auto-enabled by default for all unlinked repositories accessible to the Vercel GitHub App
Coverage can be restricted to specific accounts or repositories in Agent settings
Every push to a covered repository triggers an automatic code review
Linked projects that have deployments get additional project and deployment context in the review

What it means for builders

This turns Security Review from a deployment add-on into a general-purpose code-security tool. Previously the scanner only covered repositories tied to a live Vercel deployment; now it extends AI-driven vulnerability scanning to any GitHub repository, whether or not the code ever ships on Vercel. For teams that host some repositories outside Vercel but still use the GitHub App, every push now gets an automatic review without any project setup.

Availability and controls

Because the scanner is on by default for unlinked repositories, teams that want to limit its reach can adjust coverage in Agent settings to specific accounts or repositories. Repositories that are linked to a Vercel project with an active deployment continue to receive richer reviews, since Security Review can draw on project and deployment context that unlinked repositories do not have.

Sources

Vercel Security Review no longer requires a linked Vercel project (Vercel, November 13, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.