● Covered by 1 source · 1 reportMedium impact1 neutral
Vercel implements Device Bound Session Credentials to prevent stolen cookie reuse
Key points
- Vercel implements DBSC for login sessions.
- DBSC binds sessions to devices using TPM-stored private keys.
- Prevents reuse of stolen session cookies.
- Complements Chrome's App-Bound Encryption.
- Also launched Security Review for code scanning.
Device Bound Session Credentials Rollout
Vercel is gradually implementing Device Bound Session Credentials (DBSC) across its platform. This security measure aims to protect user login sessions from information stealer malware. The new feature was announced by Vercel's CTO Malte Ubl.
DBSC functions by binding a user's login session to their specific device. A private key, stored in the device's Trusted Platform Module (TPM), signs the session cookie. This mechanism ensures that even if a session cookie is stolen, it cannot be reused on a different device, as the private key is non-retrievable.
Enhanced Protection and Compatibility
The DBSC implementation adds a layer of security by preventing the unauthorized reuse of session cookies. It works in conjunction with existing browser protections, such as Chrome's App-Bound Encryption, which makes it more difficult for malware to extract browser cookies. DBSC is currently supported in Chrome on macOS and Windows.
Vercel is also rolling out a similar protective technology, called DPoP, for its command-line interface (CLI) to provide consistent security across its developer tools.
Security Review for Code
In addition to DBSC, Vercel has launched Security Review in public beta for Pro and Enterprise teams. This feature integrates with Vercel Agent to scan code changes on every push to connected GitHub repositories. It identifies issues like missing authorization checks and exposed secrets based on code and team-defined policies.
The Vercel Agent can also validate and commit fixes if permissions allow. Vercel has stated that Security Review scans will be free until November 10, 2026, with agent-generated fixes billed separately. This feature was developed internally and has been in use for several months.
Context and Impact
These security enhancements follow a security breach in April where attackers accessed Vercel's systems by compromising an employee's Google Workspace account at Context.ai. The attacker used this access to view internal systems and environmental variables.
The introduction of DBSC and Security Review represents Vercel's efforts to strengthen its platform's security posture, particularly for developers managing projects and deployments on vercel.com.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Vercel is rolling out Device Bound Session Credentials (DBSC) to protect user login sessions from information stealer malware. DBSC binds a login session to a user's device via a private key stored in a TPM, preventing reuse of stolen session cookies on other devices. This update enhances security for developers managing projects on vercel.com, following a previous security breach in April.