Vercel Rolls Out DBSC to Block Stolen Session Cookies
Device Bound Session Credentials ties vercel.com logins to a private key in the device's TPM, and currently works in Chrome on macOS and Windows.
Vercel has begun a gradual rollout of Device Bound Session Credentials (DBSC) for logins to vercel.com, according to bleepingcomputer.com. The feature stores a private key in the device's TPM and uses it to sign the session cookie, so a stolen cookie cannot be reused on another device.
DBSC currently works in Chrome on macOS and Windows. Vercel CTO Malte Ubl announced the feature, and the company said the rollout is gradual to handle edge cases involving OAuth apps.
Alongside DBSC, Vercel is rolling out DPoP for the Vercel CLI.
Security Review in public beta
Earlier this week, Vercel launched Security Review in public beta for Pro and Enterprise teams. The tool scans code changes pushed to connected GitHub repositories and flags issues such as missing authorization checks and exposed secrets.
Security Review scans are free until November 10, 2026, with agent-generated fixes billed separately.
Quick answers
What does DBSC protect against?
It binds the session cookie to a private key in the device's TPM, so a stolen cookie cannot be reused on another device.
Where does DBSC work?
It currently works in Chrome on macOS and Windows.
How much does Vercel Security Review cost?
Scans are free until November 10, 2026; agent-generated fixes are billed separately.