Vercel introduced Security Review in public beta on November 2 for Pro and Enterprise teams. Once enabled, the service examines pushes to connected GitHub repositories and places findings in its dashboard, with additional checks and pull-request comments for private and internal repositories.
Each review compares changed code with a base. For deployments, that base is the branch’s previous deployment; monorepo reviews are confined to the project root. Vercel says the agent reads surrounding code and evaluates team policies, including rules expressed in plain language.
The service tracks findings across deployments and marks them no longer detected when subsequent review stops finding them. With permission, Vercel Agent can validate and commit a fix. The announcement separates that action from merely reporting a vulnerability.
Vercel said review scans would be free until November 10, while agent-generated fixes would be billed separately. The release describes a public beta, not an independent assessment of detection accuracy or assurance that every repository vulnerability will be found.
NAOAT analysis
The operational change is the connection between a code observation and the deployment that contains it. That can make a finding easier to assign and revisit than a warning detached from release history. It does not expand a change-focused review into a full audit of unchanged code, runtime configuration or access granted outside the repository.
There is also a meaningful difference between a scanner no longer detecting an issue and an organization proving the affected behavior is correct. Vercel’s status language preserves that distinction. As automated fixes become part of release workflows, the remaining question is who owns acceptance of the changed behavior and its consequences for the service.