Vercel Security Review 公測釋出
Vercel Security Review now in public beta
Vercel Security Review 於 2026‑11‑03 正式進入公測，為 Pro 與 Enterprise 團隊提供 GitHub 推送即時漏洞掃描與修復建議。
AI 伴隨問答
針對這篇報導有疑問？可直接點選快捷問題或向 AI 追問背景脈絡與技術細節：
Vercel Security Review is now in public beta for Pro and Enterprise teams. Once enabled, every push to a connected GitHub repository is automatically reviewed for vulnerabilities, and findings are reported in the Vulnerabilities dashboard.
What triggers a review
Security Review runs automatically when code is pushed to a connected GitHub repository. Because reviews start from push events rather than pull requests, direct and force pushes to your production branch are reviewed as well. Every project affected by a single push is reviewed together.
What a finding includes
Each finding records the project, environment, branch, and commit, with a summary, a suggested fix, and an AI-generated severity rating.
Security Review adds its own GitHub check to each commit it reviews. When there's a pull request, it also posts findings as review comments that link back to each finding. On public repositories, finding details stay in the dashboard.
Fixes and resolution
Clicking Fix with Vercel Agent on a vulnerability report hands the finding to Vercel Agent, which proposes a fix and opens a pull request for you to review. Nothing merges until you approve it.
To fix findings with your coding agent instead, use vercel security vulnerabilities in the Vercel CLI, or copy any finding as Markdown or JSON.
Security policies
Teams can write security policies in plain language, for all projects or specific ones, to give Security Review more context about how they build. Set a team policy in Agent settings and a project policy in the project's Security settings.
Limitations
Security Review analyzes source code. It isn't a security audit, and it doesn't perform runtime or penetration testing. It helps you find vulnerabilities but doesn't guarantee your application is free of them.
Pricing
Security Review is billed at the Vercel Agent rate: provider inference at the underlying token rate with no markup, plus the Vercel Token Rate of $0.25 per million tokens (input, cached, output). Reviews run on each push to GitHub, so cost scales with how often you push and how much code changes.
Security reviews are free until November 10, 2026, and fixes made with Vercel Agent are billed at the Vercel Agent rate.
Enable Security Review in your team’s Agent settings, or read the documentation and the announcement to learn more. The CLI command needs Vercel CLI 65.10.0 or later.