Vercel Security Review puts an AI agent on every push to check for missing auth and exposed secrets

On November 2, 2026, Vercel introduced Security Review, a scanning capability in Vercel Agent that joins Code Review and Investigation. On every push to a connected GitHub repository, including direct and force pushes to production branches, the agent reads the changed code, traces how it can be reached, checks for existing protections, and rechecks findings before reporting issues such as missing authorization checks or exposed secrets. Teams can also write security policies in plain language.

Findings appear in a Security dashboard, as pull request comments, and through the Vercel CLI, with a GitHub check on private repositories. Users can ask Vercel Agent to fix a finding or pass the CLI output to their own coding agent. Vercel says it is not a security audit, runtime test, or penetration test. Reviews are free until November 10, 2026, then billed at the Vercel Agent rate: provider token prices with no markup plus $0.25 per million tokens.