Vercel Implements Device-Bound Credentials to Prevent Session Cookie Theft

Vercel is deploying Device Bound Session Credentials (DBSC) to protect its platform against infostealer malware. The new security measure binds user login sessions to specific hardware, preventing attackers from using stolen session cookies on unauthorised devices.

The implementation aims to neutralise a common tactic used by modern malware, where attackers exfiltrate browser cookies to bypass multi-factor authentication (MFA) and hijack active sessions. By using DBSC, Vercel ensures that even if a cookie is successfully stolen, it remains useless to a threat actor attempting to access the account from a different machine.

Hardware-Backed Authentication

The DBSC mechanism functions by storing a private key within a device’s Trusted Platform Module (TPM). The TPM is a dedicated microcontroller designed to secure hardware through integrated cryptographic keys, similar to the technology used for biometric fingerprint sensors on laptops and smartphones.

Vercel CTO Malte Ubl explained that the private key used to sign the session cookie is stored securely within the TPM. This key cannot be retrieved by the user, the platform, or any malware present on the system, creating a cryptographic link between the session and the physical device.

This rollout complements Google Chrome’s App-Bound Encryption, which aims to make it more difficult for malware to extract cookies from the browser. Vercel’s DBSC adds an additional layer of defence by ensuring that even a successfully extracted cookie cannot be replayed elsewhere. The feature is currently being rolled out for Chrome users on macOS and Windows.

Code Scanning and CLI Security

In addition to session protection, Vercel is expanding its security toolset with the launch of “Security Review” in public beta. Designed for Pro and Enterprise teams, this feature uses the Vercel Agent to scan code changes during every push to connected GitHub repositories. The system identifies potential vulnerabilities, such as exposed secrets or missing authorisation checks, and can automatically suggest or commit fixes if permissions allow.

Vercel has stated that Security Review scans will be free until 10 November 2026, although agent-generated fixes will be billed separately. The company is also implementing Demonstrating Proof-of-Possession (DPoP) for the Vercel Command Line Interface (CLI) to provide similar session-binding protections for developers using terminal-based workflows.

The focus on advanced authentication follows a security incident in April, where attackers compromised a Google Workspace account belonging to a Context.ai employee to gain access to Vercel’s internal systems. While the breach was limited to a subset of customers, it highlighted the necessity of robust identity and access management protocols across the platform.