Vercel Security Review scans every push and offers to fix what it finds

Vercel has launched Security Review in public beta for Pro and Enterprise teams. It runs automatically on every push to a connected GitHub repository, reading the diff and the surrounding code to trace how changed code can be reached and whether existing protections cover it, catching things like missing authorisation checks or exposed secrets.

Findings show up as GitHub review comments with a summary, a suggested fix and an AI-generated severity rating. Clicking “Fix with Vercel Agent” hands the finding over and opens a pull request with a proposed fix for you to review. Teams can also write security policies in plain language, scoped to all projects or specific ones, to give the reviewer more context about how they build. For now it only works with GitHub, and in a monorepo a review scopes to the project root.

Reviews are free until 10 November. After that, Security Review bills at the Vercel Agent rate: the underlying provider’s token cost plus $0.25 per million tokens, with fixes from Vercel Agent billed separately again.

Why it matters: this folds vulnerability scanning and an AI-generated fix straight into the push workflow most teams already use, rather than a separate scanning tool or dashboard. Worth trying during the free window before deciding if the ongoing token cost is worth it for your repos.

The caveat: Vercel is explicit that this isn’t a security audit, it analyses source code only and does no runtime or penetration testing.