## **Vercel** Implements DBSC to Counter Infostealer Malware **Vercel** is rolling out **Device Bound Session Credentials (DBSC)** across its platform, a critical defense mechanism against the pervasive threat of information stealer malware. This new feature, announced by **Vercel's CTO Malte Ubl** on X, fundamentally changes how login sessions are handled. **DBSC** works by binding a user's login session to their specific device using a private key stored in the device's **Trusted Platform Module (TPM)**. This means that even if a session cookie is stolen, it cannot be reused on a different device, effectively neutralizing a common attack vector for infostealers. As **Malte Ubl** explained, the private key is permanently stored in the **TPM**—the same secure hardware used by biometric sensors—and is never retrievable by **Vercel**, the user, or malicious software. This robust design significantly raises the bar for attackers attempting to hijack sessions. This move by **Vercel** complements existing browser-level protections, such as **Google Chrome's App-Bound Encryption**, by adding an extra layer of defense that prevents the reuse of stolen session cookies. Currently, **DBSC** is being gradually rolled out for **Chrome** on **macOS** and **Windows**, with careful consideration for **OAuth** application compatibility. A similar protective technology, **DPoP**, is also being implemented for the **Vercel CLI**. ## **Security Review** Public Beta Launched In a separate but equally important security enhancement, **Vercel** has launched **Security Review** in public beta for Pro and Enterprise teams. This new feature integrates with the **Vercel Agent** to automatically scan code changes on every push to connected **GitHub** repositories.  *Source: Vercel* The system leverages code and team-defined policies to identify and flag critical issues, including missing authorization checks and exposed secrets. Where permissions allow, the **Vercel Agent** can even validate and commit automated fixes, streamlining the security remediation process. **Vercel's** security team has been using this feature internally for months, with **Ubl** confirming its effectiveness before its broader release. The scans provided by **Security Review** will be free until November 10, 2026, though agent-generated fixes will be billed separately. ## Addressing Past Incidents These proactive security measures follow a breach **Vercel** experienced in April, where attackers gained access to internal systems by compromising an employee's **Google Workspace** account at **Context.ai**. The incident involved attackers viewing environment variables not marked as sensitive, with a threat actor impersonating **ShinyHunters** later attempting to sell allegedly stolen data. These new initiatives underscore **Vercel's** commitment to fortifying its platform against evolving cyber threats.