Vercel rolls out new protection against stolen session cookie attacks

5 November 2026 2 min read هدهد تك | Hudhud Tech

Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. This feature binds a login session to the user’s device using a private key stored in a TPM, ensuring that even if a session cookie is stolen, it cannot be reused on another device.

Malte Ubl, Vercel’s CTO, announced the new feature on X, emphasizing that the private key is securely stored and cannot be retrieved by anyone, including Vercel or the user. This mechanism enhances the security of logins to Vercel’s platform at vercel.com, where developers manage their projects and deployments.

DBSC complements Chrome’s App-Bound Encryption, which aims to prevent information stealer malware from extracting browser cookies. By preventing the reuse of stolen session cookies on different devices, DBSC adds an additional layer of security.

The feature is currently compatible with Chrome on macOS and Windows, and its rollout is being conducted gradually to address potential edge cases involving OAuth applications. Additionally, Vercel is introducing a similar protective technology called DPoP for the Vercel CLI.

Launch of Security Review

Earlier this week, Vercel launched Security Review in public beta for Pro and Enterprise teams. This feature, part of Vercel Agent, scans code changes on every push to connected GitHub repositories once enabled. It utilizes code and team-defined policies to identify issues such as missing authorization checks and exposed secrets.

If permissions allow, the Vercel Agent can validate and commit fixes automatically. Vercel announced that Security Review scans will be free until November 10, 2026, while fixes generated by the agent will incur separate charges.

Ubl mentioned that the security team had internally deployed this feature a couple of months ago, and its effectiveness prompted the decision to make it widely available.

In April, Vercel experienced a security breach that affected a subset of customers. Attackers accessed its systems by compromising an employee’s Google Workspace account, allowing them to view internal systems and environment variables that were not marked as sensitive. A threat actor impersonating ShinyHunters attempted to sell the allegedly stolen source code, access keys, and database data.

Source: BleepingComputer

What do you think of this story?