Vercel begins rolling out device-bound sessions to block stolen cookie replay
Session cookies stolen by infostealer malware will no longer work from another machine on Chrome for macOS and Windows, once the staged rollout reaches a user.
Vercel has begun a gradual rollout of Device Bound Session Credentials on its platform, a measure aimed at information-stealing malware. Announced by CTO Malte Ubl on X, the feature ties a login session to the user's device by using a private key held in the device's TPM, so a stolen session cookie cannot be replayed from another machine. The protection currently works in Chrome on macOS and Windows, and the staged release is meant to handle edge cases involving OAuth apps. Vercel is also introducing a similar mechanism called DPoP for its CLI. Separately, the company launched Security Review in public beta for Pro and Enterprise teams, which scans code on each push to connected GitHub repositories, with scans free until November 10, 2026. The moves follow an April breach in which attackers reached internal systems through a compromised employee account at Context.ai.
Why it matters
The change targets a common route into developer accounts: malware copies a session cookie and reuses it elsewhere. Binding sessions to a key stored in the device's TPM means that copied cookie alone is no longer enough to log in. The rollout is gradual and currently covers Chrome on macOS and Windows, so protection depends on both the browser and the operating system. The move follows an April breach in which attackers got into Vercel's internal systems through a compromised employee account at Context.ai, which shows why the company is tightening how sessions are protected.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.