Vercel Security Review, now in public beta, is a capability inside Vercel Agent for Pro and Enterprise teams. Once enabled, it scans every push to a connected GitHub repository for issues such as missing authorization checks, code injection, and exposed credentials, including direct pushes to a production branch that never open a pull request. Vercel is releasing it as models make old flaws easier to turn into working exploits, and as agents write more of the code teams ship, often without a consistent security pass. Each review covers only the changed code, compares it with what is already deployed, traces how that code can be reached, and rechecks a finding before reporting it. Findings appear in a Vulnerabilities dashboard with a summary, a suggested fix, and an AI-generated severity rating. Private and internal repositories also get a GitHub check and pull request comments. On public repositories, details stay in the dashboard so an unpatched issue is not posted in the open. From a finding, Vercel Agent can confirm the issue is still present, apply the smallest change it can, update tests, and open a pull request that does not merge until someone approves it. Teams can also pull the same findings with the Vercel CLI, or copy them as Markdown or JSON for another coding agent. Reviews are free until November 10, 2026. Fixes made with Vercel Agent are billed at the agent rate, which is the model provider's token price with no markup, plus $0.25 per million tokens. Teams can write security policies in plain language so later reviews follow how they build. The scan reads source code and does not test the running application. Vercel CEO Guillermo Rauch said the capability was built by the company's security team and extends an internal agent already used to audit Vercel code.