Vercel Deploys Device Bound Session Credentials to Block Stolen Cookie Reuse
Vercel is rolling out Device Bound Session Credentials (DBSC) on its platform to counter infostealer malware that steals session cookies. Announced by CTO Malte Ubl, the feature binds login sessions to a device using a private key stored in the device's TPM, so a stolen cookie cannot be replayed on another machine. The rollout currently supports Chrome on macOS and Windows and is being staged gradually to handle OAuth edge cases. Vercel is also deploying DPoP for its CLI and has launched Security Review, a public beta feature in Vercel Agent that scans code pushed to connected GitHub repositories for issues like missing authorization checks and exposed secrets, with optional automated fixes.
Detalhes técnicos
DBSC signs session cookies with a non-exportable private key stored in the TPM, preventing reuse of exfiltrated cookies even if malware extracts them from the browser. This complements Chrome's App-Bound Encryption, which already hardens cookie storage against extraction. Security Review integrates into the CI/CD push workflow, applying code and team-defined policies to flag vulnerabilities, and can autonomously validate and commit fixes when permitted; scans are free until November 10, 2026.
The article also notes that in April 2026 Vercel suffered a breach after an employee's Google Workspace account at Context.ai was compromised, allowing attackers to view unmarked-sensitive environment variables; a threat actor impersonating ShinyHunters later attempted to sell the allegedly stolen source code, access keys, and database data.
Linha do tempo
-
Vercel Deploys Device Bound Session Credentials to Block Stolen Cookie Reuse
ler a análise desta fonte ocultar
Vercel is rolling out Device Bound Session Credentials (DBSC) on its platform to counter infostealer malware that steals session cookies. Announced by CTO Malte Ubl, the feature binds login sessions to a device using a private key stored in the device's TPM, so a stolen cookie cannot be replayed on another machine. The rollout currently supports Chrome on macOS and Windows and is being staged gradually to handle OAuth edge cases. Vercel is also deploying DPoP for its CLI and has launched Security Review, a public beta feature in Vercel Agent that scans code pushed to connected GitHub repositories for issues like missing authorization checks and exposed secrets, with optional automated fixes.
Technical Details
DBSC signs session cookies with a non-exportable private key stored in the TPM, preventing reuse of exfiltrated cookies even if malware extracts them from the browser. This complements Chrome's App-Bound Encryption, which already hardens cookie storage against extraction. Security Review integrates into the CI/CD push workflow, applying code and team-defined policies to flag vulnerabilities, and can autonomously validate and commit fixes when permitted; scans are free until November 10, 2026.
The article also notes that in April 2026 Vercel suffered a breach after an employee's Google Workspace account at Context.ai was compromised, allowing attackers to view unmarked-sensitive environment variables; a threat actor impersonating ShinyHunters later attempted to sell the allegedly stolen source code, access keys, and database data.