# Vercel Security Review enters public beta for Pro and Enterprise teams

published: 2026-11-04T05:05:26.432Z
topic: infrastructure
source: https://vercel.com/changelog/vercel-security-review-public-beta
url: https://aiagentnews.io/stories/vercel-security-review-enters-public-beta-for-pro-and-enterprise-teams

Vercel Security Review is now in public beta for Pro and Enterprise teams. Once enabled, it automatically reviews every push to a connected GitHub repository for vulnerabilities and reports findings in the Vulnerabilities dashboard.

Security Review runs when code is pushed to a connected GitHub repository, including direct and force pushes to the production branch, because reviews start from push events rather than pull requests. Every project affected by a single push is reviewed together. Each finding records the project, environment, branch and commit, along with a summary, a suggested fix and an AI-generated severity rating.

Security Review adds its own GitHub check to each reviewed commit. When a pull request exists, it also posts findings as review comments linking back to each finding, while finding details on public repositories stay in the dashboard. Clicking Fix with Vercel Agent hands a finding to Vercel Agent, which proposes a fix and opens a pull request for review; nothing merges until it is approved. Developers can also use the vercel security vulnerabilities command in the Vercel CLI, which needs version 65.10.0 or later, or copy findings as Markdown or JSON.

Teams can write security policies in plain language for all projects or for specific ones, set in Agent settings and in each project's Security settings. Vercel says Security Review analyzes source code only and is not a security audit or a runtime or penetration test. Reviews are free until November 10, 2026, after which they are billed at the Vercel Agent rate, plus a Vercel Token Rate of $0.25 per million tokens.

## Why it matters if you build agents

Teams using Vercel with GitHub can get automated vulnerability checks on every push without adding a separate scanner to their pipeline.

Agent builders should note that the review covers source code only, so runtime and penetration testing still need separate tools, and that costs scale with push frequency once the free period ends.