Vercel is gradually deploying Device Bound Session Credentials to protect its platform against information stealer malware, according to Bleeping Computer.
The new security feature, announced by Chief Technology Officer Malte Ubl, binds user login sessions to a specific device using a private key stored in a Trusted Platform Module. This ensures that even if a session cookie is stolen, it cannot be reused on a different device. The technology currently functions within the Chrome browser on macOS and Windows, with a broader rollout planned. This initiative complements existing browser-level protections like App-Bound Encryption. Additionally, Vercel is introducing a similar mechanism called DPoP for its command-line interface.
Alongside these session protections, the company launched a public beta for Security Review, a tool that scans code changes for vulnerabilities such as exposed secrets or missing authorization checks. These updates follow a security breach earlier this year where attackers compromised an employee account to access internal systems. By integrating these automated defenses, Vercel aims to mitigate risks associated with credential theft and unauthorized access, providing developers with more robust security for their web applications and deployments. The company plans to offer free security scans until November 10, 2026.
Source: Bleeping Computer
