Vercel Security Review enters public beta for Pro and Enterprise teams

Reviews start from push events

According to Vercel, Security Review runs automatically whenever code is pushed to a connected GitHub repository. Because reviews start from push events rather than pull requests, direct and force pushes to a production branch are reviewed as well. When a single push affects several projects, every affected project is reviewed together.

Each finding records the project, environment, branch and commit. It also includes a summary, a suggested fix and an AI-generated severity rating. Security Review adds its own GitHub check to each commit it reviews. Where a pull request exists, it also posts findings as review comments that link back to each finding in the dashboard. On public repositories, finding details stay in the dashboard.

Fixing findings and setting policies

On a vulnerability report, a user can click Fix with Vercel Agent. This hands the finding to Vercel Agent, which proposes a fix and opens a pull request for review. Vercel states that nothing merges until the user approves it.

Teams that prefer to use their own coding agent have two options. They can run vercel security vulnerabilities in the Vercel CLI, which requires Vercel CLI 65.10.0 or later, or copy any finding as Markdown or JSON.

Teams can also write security policies in plain language, either for all projects or for specific ones, to give Security Review more context about how they build. A team policy is set in Agent settings, and a project policy in the project's Security settings.

Pricing and limitations

Security Review is billed at the Vercel Agent rate. That means provider inference at the underlying token rate with no markup, plus the Vercel Token Rate of $0.25 per million tokens (input, cached, output). Since reviews run on each push to GitHub, Vercel notes that cost scales with how often teams push and how much code changes.

Security reviews are free until November 10, 2026. Fixes made with Vercel Agent are billed at the Vercel Agent rate.

Vercel is clear about the scope of the tool. Security Review analyzes source code. It is not a security audit and does not perform runtime or penetration testing. In Vercel's words, it helps find vulnerabilities but does not guarantee an application is free of them.

What it means for teams

For Pro and Enterprise teams already using GitHub with Vercel, the beta adds automated vulnerability checks to every push, including pushes that bypass pull requests. The free period ends on November 10, 2026, so teams that enable it now can see how review volume translates into token costs before billing begins. Teams can enable the feature in their Agent settings, and Vercel points to its documentation and announcement for more detail.