Vercel rolls out new protection against stolen session cookie attacks

Vercel has begun a gradual rollout of Device Bound Session Credentials (DBSC), a feature designed to defend against information stealer malware by tying login sessions to a specific device. The rollout was announced by Vercel's CTO Malte Ubl on X. DBSC works by storing a private key in a device's Trusted Platform Module, the same hardware component used by fingerprint sensors and similar biometric devices, and using that key to sign the user's session cookie. As a result, even if a session cookie is stolen, it cannot be used to authenticate from another device. "The private key can never be retrieved ever again. Not by us, not by you, not by the malware," Ubl said. The feature applies to logins at vercel.com, where developers manage their projects and deployments. Vercel is a cloud platform used to deploy and host websites, web applications, and AI agents, and the company also develops the widely used Next.js web framework. DBSC complements Chrome's App-Bound Encryption, which makes it harder for infostealer malware to extract browser cookies. While App-Bound Encryption focuses on protecting cookies at rest, DBSC adds another layer by ensuring stolen session cookies cannot be reused elsewhere. The feature currently works in Chrome on macOS and Windows, and Vercel is rolling it out gradually to ensure edge cases involving OAuth apps are handled appropriately. Separately, Vercel is rolling out a similar protective technology called DPoP for the Vercel CLI. The company also launched Security Review in public beta earlier this week for Pro and Enterprise teams. The feature, part of Vercel Agent, scans code changes on every push to connected GitHub repositories once enabled. It uses code analysis and team-defined policies to flag issues such as missing authorization checks and exposed secrets, and, if permissions allow, the agent can validate and commit fixes. Vercel says Security Review scans will be free until November 10, 2026, while agent-generated fixes will be billed separately. Ubl said Vercel's security team shipped the feature internally a couple of months ago and that it had already proven its worth, prompting the company to make it broadly available. The security push comes months after Vercel suffered a breach in April that impacted a subset of customers. Attackers gained access to Vercel's systems by compromising an employee's Google Workspace account at Context.ai, then used that access to reach internal systems and view environment variables that had not been marked as sensitive. A threat actor impersonating the ShinyHunters group subsequently attempted to sell allegedly stolen source code, access keys, and database data. Vercel's adoption of DBSC reflects a broader industry response to the growing threat of infostealer malware, which has been distributed through compromised developer tools and software pipelines in recent incidents affecting services such as LiteLLM, OVHcloud's CLI, and third-party GitHub repositories.