Vercel is gradually rolling out Device Bound Session Credentials (DBSC), a new safeguard designed to stop stolen session cookies from being used on another device. The feature applies to logins at vercel.com, where developers manage projects and deployments on the platform.
Vercel CTO Malte Ubl announced the rollout on X. He said DBSC ties a login session to a private key stored in the device’s Trusted Platform Module (TPM). The key signs the session cookie and cannot be retrieved, according to Ubl, so a stolen cookie alone cannot be reused elsewhere.
The measure complements Chrome’s App-Bound Encryption, which makes it more difficult for information-stealer malware to extract browser cookies. DBSC adds protection against using a cookie after it has been stolen. It currently works in Chrome on macOS and Windows, with the gradual rollout intended to address edge cases involving OAuth apps. Vercel is also rolling out a similar technology, DPoP, for its CLI.
Separately, Vercel recently launched Security Review in public beta for Pro and Enterprise teams. When enabled, the Vercel Agent scans changes pushed to connected GitHub repositories and uses code and team-defined policies to flag problems such as missing authorization checks or exposed secrets. If granted permission, the agent can validate and commit fixes. Scans are free until November 10, 2026; agent-generated fixes are billed separately.
Sources: BleepingComputer.