Overview
Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a defense against information-stealer malware, according to BleepingComputer. CTO Malte Ubl announced the change on X.
How DBSC Works
DBSC binds a login session to the device that created it. A private key held in the device's TPM signs the session cookie, so a cookie copied off a victim's machine is useless on any other device. Ubl said: "The private key can never be retrieved ever again. Not by us, not by you, not by the malware."
Infostealers commonly steal browser cookies and replay them to skip passwords and MFA. DBSC targets that step directly.
Scope and Rollout
- Applies to logins at vercel.com
- Currently works in Chrome on macOS and Windows
- Rolled out gradually so edge cases involving OAuth apps can be handled properly
- Complements Chrome's App-Bound Encryption, which makes cookie extraction harder
- Vercel is also rolling out a similar technology, DPoP, for the Vercel CLI
Context
The move follows an April breach in which attackers compromised an employee's Google Workspace account at Context.ai and reached Vercel. Vercel also launched Security Review in public beta this week, with scans free until November 10, 2026.
What Teams Should Do
- Use Chrome on a supported OS to benefit from the protection on Vercel logins.
- Keep other sensitive sessions on services that support device binding or short-lived tokens.
- Continue to harden endpoints against infostealers; DBSC reduces replay risk but does not stop credential theft in general.