Vercel is gradually rolling out Device Bound Session Credentials (DBSC) as a defense against information stealer malware, binding a login session to the user's device so a stolen session cookie cannot be reused on another device. The feature, announced by Vercel's CTO Malte Ubl on X, applies to logins at vercel.com, where developers manage projects and deployments.
Vercel is a cloud platform used by developers to deploy and host websites, web applications and AI agents, and it also develops the Next.js web framework.
According to Ubl, DBSC stores a private key in the device's TPM, the same component used by fingerprint sensors and similar biometric hardware on laptops and phones, and uses that key to sign the session cookie. “The private key can never be retrieved ever again,” Ubl explained. “Not by us, not by you, not by the malware.”
The rollout complements Chrome's App-Bound Encryption, which makes it harder for infostealer malware to extract browser cookies, by adding a layer that stops stolen cookies from being reused on other devices. DBSC currently works in Chrome on macOS and Windows, and Vercel is rolling it out gradually to handle edge cases involving OAuth apps.
Separately, Vercel is rolling out a similar protective technology, DPoP, for its command-line interface.
Earlier this week, the company launched Security Review in public beta for Pro and Enterprise teams. The feature adds to Vercel Agent and scans code changes on every push to connected GitHub repositories once enabled, using code and team-defined policies to flag issues such as missing authorization checks and exposed secrets. If permissions allow, the agent can validate and commit fixes.
Vercel says Security Review scans will be free until November 10, 2026, while agent-generated fixes will be billed separately. Ubl said Vercel's security team shipped the feature internally a couple of months ago and that it proved its worth, prompting the decision to make it broadly available.
In April, Vercel suffered a security breach affecting a subset of customers, in which attackers gained access to its systems by compromising an employee's Google Workspace account at Context.ai. Vercel said the attacker used that access to reach internal systems and view environment variables that had not been marked as sensitive. A threat actor impersonating ShinyHunters attempted to sell allegedly stolen source code, access keys and database data.
Analysis
Why This Matters
- Developers who log in to Vercel are the immediate users of DBSC, but the approach of binding sessions to device hardware is a model other platforms could follow against infostealer malware.
- The gradual rollout, limited for now to Chrome on macOS and Windows, means protection will not reach every user at once, and OAuth edge cases are still being handled.
- Security Review adds automated scanning of code pushes, with free scans until November 10, 2026 and charges for agent-generated fixes.
Background
Information stealer malware typically harvests saved credentials and session cookies from browsers. A stolen session cookie can let an attacker impersonate a logged-in user without needing the password. DBSC, a specification developed in the Chrome ecosystem, aims to make such cookies useless on another machine by tying them to a hardware-held key. Vercel's move follows an April breach in which attackers reached internal systems through a compromised employee account at a third-party service.
Key Perspectives
- Malte Ubl, Vercel CTO: says DBSC stores a private key in the device's TPM and signs the cookie with it, and that the key can never be retrieved again, not by Vercel, the user or malware.
- Vercel: says Security Review scans are free until November 10, 2026, with agent-generated fixes billed separately, and that the feature was first shipped internally by its security team.
What to Watch
- How quickly Vercel expands DBSC beyond Chrome on macOS and Windows, and whether it resolves the OAuth edge cases cited for the gradual rollout.
- Adoption of Security Review after the free-scan period ends on November 10, 2026, and how billing for agent-generated fixes is received.
- Whether other developer platforms follow with device-bound session credentials, and how infostealer operators adapt.
