Device Bound Session Credentials: Vercel's Cookie Fix

Stealing a session cookie is one of the neatest tricks in modern account takeover, because the cookie is issued after login and after multi-factor authentication. Vercel is now closing that gap on its own platform by rolling out Device Bound Session Credentials, known as DBSC, for logins at vercel.com. The company behind Next.js is also opening an AI code reviewer called Security Review to Pro and Enterprise teams.

• DBSC ties a Vercel login session to a private key held in secure hardware such as a TPM or Secure Enclave
• It currently works in Chrome on Windows and macOS, and the rollout is gradual
• Vercel is working on a related technology, DPoP, for its command-line tool
• Security Review is in public beta, with scans free until November 10, 2026

How Do Device Bound Session Credentials Work?

Info-stealing malware such as Lumma, RedLine and Vidar grabs browser cookies along with passwords. An attacker who replays a stolen session cookie can walk into an account without the password or the second factor, an attack known as pass-the-cookie.

Device Bound Session Credentials change the math. The browser generates a key pair and stores the private key in secure hardware, where it cannot be exported. The server then issues short-lived cookies, and the browser must keep refreshing them by proving it holds that key. A stolen cookie expires quickly, and without the key the attacker cannot renew it. Vercel CTO Malte Ubl summed up the property plainly: the private key can't be retrieved by Vercel, by the user or by malware.

Google has also been pushing this defense in Chrome, as we noted in our look at Google's DBSC scam protections. If a device has no secure key storage, Google says DBSC falls back to standard behavior without breaking login.

Why the Vercel DBSC Rollout Is Gradual

Help Net Security reports that Ubl pointed to the technology's newness and to special cases around OAuth apps as the reason for moving slowly. Browser support is the other limit today. Vercel is working on a polyfill for other browsers, though Ubl says it is less secure and would prefer broader native adoption.

The rollout also follows a security incident Vercel disclosed in April, which reached a subset of customers. Binding sessions to hardware is a sensible response to the identity attacks that have become common across developer platforms.

What Does Vercel Security Review Check?

Security Review is an AI code scanner inside Vercel Agent. Once enabled, it runs on every push to a connected GitHub repository, looks at code that changed since the branch's previous deployment, reads the surrounding code, traces how the change can be reached and checks for existing protections before reporting anything.

It flags problems such as missing authorization checks and exposed secrets. Findings appear as pull request comments, in the Security dashboard and through the CLI. Teams can ask the agent to verify a finding and commit a minimal fix with updated tests, or pass the details to their own coding agent. Vercel says agent-generated fixes are billed separately.

For teams on the platform, the action items are simple: try Security Review during the free window, and sign in from Chrome on a TPM-equipped machine once DBSC reaches your account. Our AI security section tracks more defensive tools like these.

Sources: BleepingComputer — November 4, 2026; Help Net Security — November 5, 2026.