devopsy.kinsta.cloud

Tag: Vercel

Vercel’s deepsec Brings AI-Powered Security Scanning Into the Development Workflow

Security has long been the last item on the checklist. Code gets written, reviewed, merged—and then, somewhere down the line, a security team takes a look. That model worked when development moved at a human pace. It doesn’t work as well when AI writes and refactors code faster than any team can keep up with.

Vercel is taking a direct shot at that problem with the open-source release of deepsec, an agent-powered security harness that runs on your own infrastructure and surfaces hard-to-find vulnerabilities in large codebases.

How It Works

Deepsec uses Claude and Codex to conduct a tailored investigation of a codebase, starting with static analysis to identify security-sensitive files. From there, coding agents investigate each candidate, tracing data flows, checking for mitigations, and producing actionable findings with severity ratings.

The process runs in five stages: scan, investigate, revalidate, enrich, and export.

The scan stage runs roughly 110 regex matchers across the codebase with no AI calls involved. On a 2,000-file project, it takes about 15 seconds. From there, agents investigate each flagged file, a second agent filters out false positives, git metadata is used to identify the contributors best positioned to fix each issue, and findings are exported in a format that can feed directly into ticketing systems—for both humans and coding agents.

For teams with large repos, deepsec supports fanout to Vercel Sandboxes for remote parallel execution. Scans on Vercel’s own codebases routinely scale up to 1,000 or more concurrent sandboxes.

Built for the AI Development Era

AI-accelerated coding increases the volume of code changes, reduces developer familiarity with generated patterns, makes refactors constant, and causes security debt to quietly compound. Traditional late-stage security reviews can’t keep up with this pace.

That’s the core argument behind deepsec. Security review needs to move at the same speed as development—which means pulling it into the same agentic workflow developers already use.

What to Know Before You Use It

There are a few things worth noting. Deepsec is configured to use the best models at maximum thinking levels, meaning scans can cost thousands—or even tens of thousands—of dollars for large codebases. That’s not a small line item, but Vercel says customers have found it worth the investment given how quickly they were able to patch vulnerabilities that might otherwise have gone unnoticed.

The false-positive rate is roughly 10 to 20%, and the revalidation step is specifically designed to have the agent further verify its findings, thereby reducing it.

Deepsec also works best for applications and services. Libraries and frameworks may require custom prompts and scanners. The tool ships with a plugin system to handle those cases.

One thing you don’t need: a specialized security-focused AI model. Deepsec is fully functional with standard Claude and Codex subscriptions, and ships with a classifier that checks whether a task was refused after each research step.

Getting Started

To get started, run npx deepsec init at the root of your repository. This creates a .deepsec directory to configure the system and store a catalog of investigations. From there, you can run scans locally or scale out using Vercel Sandboxes.

The project is open source and available on GitHub. Vercel has made it clear that it’s still early—and that feedback and contributions are welcome.

For DevOps teams looking to tighten the loop between shipping and securing, deepsec is worth a closer look.

May 8, 2026
GitHub Adds 37 New Secret Detectors in March, Extends Scanning to AI Coding Agents

GitHub shipped four secret scanning updates in March that collectively represent the most significant expansion of the platform’s credential detection capabilities in months. The numbers: 37 new secret detectors across 22 providers; 39 token types now push-protected by default; new validity checks for AI and developer infrastructure tokens; and — most notably — secret scanning that now works inside AI coding agents through the GitHub MCP Server.

For DevOps teams managing repositories where AI agents are increasingly generating code and opening pull requests, this last addition changes the security equation.

What Shipped in March

March 10: The big batch. 28 new secret detectors from 15 providers, including Vercel (six token types alone), Snowflake, Supabase, Lark, and Shopify. Push protection expanded to 39 detectors enabled by default — meaning commits containing matching secrets are blocked before they reach the repository. Validity checks added for Airtable, DeepSeek, npm, Pinecone, and Sentry tokens, automatically verifying whether detected secrets are still active so teams can prioritize remediation.

March 17: Secret scanning in AI coding agents. The GitHub MCP Server can now scan code changes for exposed secrets before commits or pull requests are made. In MCP-enabled environments, AI coding agents invoke the secret-scanning engine in response to prompts and instructions. Results include structured data with locations and details for any secrets found. This is in public preview for repositories with GitHub Secret Protection enabled.

March 23: Push protection exemptions at the repo level. Organizations can now designate specific roles, teams, and apps as exempt from push protection enforcement directly from repository settings. Previously, exemptions could only be managed at the organization and enterprise level. Exemption status is evaluated at the time of each push.

March 31: Nine more detectors. New secret types from seven providers, including LangChain, Salesforce, and Figma. Secrets from Figma, Google, OpenVSX, and PostHog are now push-protected by default. Validity checks added for npm access tokens.

Why the AI Agent Integration Matters Most

The March 17 MCP Server integration is the update that changes the operational model. When AI coding agents generate code — whether through GitHub Copilot, Claude Code, or any MCP-compatible tool — that code can now be scanned for secrets before it’s committed. The agent doesn’t need to know what a secret looks like. It sends the code to GitHub’s scanning engine and receives structured results.

This addresses a specific risk that’s growing as the volume of AI-generated code increases. Anthropic reported that code output per engineer grew 200% last year. GitHub Copilot’s coding agent now handles tasks autonomously through Jira and GitHub Issues. Cursor’s cloud agents run in isolated VMs, producing merge-ready PRs. The more code agents generate, the more opportunities for secrets to leak — whether from training data patterns, hallucinated credentials, or copy-paste from context that includes real tokens.

Having secret scanning available inside the agent’s workflow — not just as a post-commit gate — means credentials can be caught before they enter the repository at all. That’s earlier in the pipeline than push protection, which catches secrets at commit time, and earlier than alert-based scanning, which catches them after the fact.

“GitHub embedding secret scanning into its MCP Server positions credential detection where AI-generated code originates, inside the agent workflow. As coding agents produce pull requests autonomously, security enforcement that operates at commit time or post-commit faces a growing gap between code velocity and detection speed,” according to Mitch Ashley, VP and practice lead for software lifecycle engineering at The Futurum Group.

“Organizations deploying AI coding agents at scale need layered detection that starts inside the agent’s execution context. Teams applying the same credential hygiene assumptions to agent-generated code as human-written code will underestimate the exposure.”

The Provider Coverage Story

The specific providers added in March tell their own story about where secrets are leaking. Vercel got six new token types in a single update. Snowflake, Supabase, and Pinecone — core infrastructure for AI applications — all received new detectors. LangChain tokens are now detected, reflecting how quickly the AI agent framework ecosystem has become part of production infrastructure. DeepSeek tokens got validity checks, acknowledging the model provider’s growing developer footprint.

The push protection defaults are equally telling. When GitHub enables push protection by default for a token type, it means the pattern is reliable enough to block commits without generating excessive false positives. The expansion to 39 token types — including Airtable, Databricks, Heroku, PostHog, and Shopify — reflects confidence in the detection accuracy and a bet that developers would rather be blocked at commit time than deal with a leaked credential after the fact.

For free public repositories, push protection defaults apply automatically. That’s a significant security baseline for open-source projects where contributors may inadvertently commit credentials.

Validity Checks and Remediation Priority

The expanded validity checks for npm, Airtable, DeepSeek, Pinecone, and Sentry tokens address a practical problem in secret scanning: alert fatigue. Not every detected secret is an active credential. Some have been rotated. Some have expired. Some were test values that never worked.

Validity checks automatically verify whether a detected secret is still active. This lets security teams prioritize remediation — an active DeepSeek API key in a public repository is an immediate problem, while an expired Sentry token from a test environment can wait. GitHub previously improved validity checks for AWS Access Key IDs, where most alerts labeled “unknown” switched to “valid” or “invalid” after the update. That same pattern is now extending to more provider tokens.

What This Means for DevOps

March’s updates reflect a security infrastructure that’s adapting to how code is actually being produced in 2026. AI agents generate code at scale. That code flows through automated pipelines. Secrets can leak at any point — from the agent’s context, from patterns in training data, from copy-paste in prompts, from environment variables that get hardcoded by mistake.

GitHub’s response is to push detection earlier and make it available in more contexts: Inside AI coding agents via MCP, at commit time via push protection, and post-commit via alert scanning with validity checks. Each layer catches what the previous one missed.

The push protection exemptions at the repository level are the governance complement. Not every push needs to be blocked — CI/CD service accounts, security testing tools, and specific team roles may need exemptions. Managing those exemptions at the repo level rather than only at the org level gives teams more granular control without requiring administrator intervention for every exception.

For teams running AI coding agents in production, the recommended sequence is clear: Enable the GitHub MCP Server with secret scanning, enable push protection with appropriate exemptions, and use validity checks to prioritize remediation of active credentials. That gives you three layers of detection before a secret reaches production.

April 1, 2026
Vercel Adds Observability Tools to Web Application Framework

Vercel today announced it has added a suite of observability tools to its platform for building web applications using Next.js, an instance of the open source React framework based on a JavaScript library.

Vercel CTO Malte Ubl said the Vercel Monitoring tools make it simpler for developers to troubleshoot applications without relying on a DevOps team to surface data. Instead, developers can take advantage of Vercel Monitoring tools to access metrics that track user interface and application programming interface (API) issues, he added.

That capability is not intended to replace the need for observability tools employed by DevOps teams. Instead, the goal is to provide metrics that are specific to issues that developers encounter as an application is being built or after it has been deployed so they can be addressed.

Developers can select from pre-made queries provided by Vercel or create their own by defining what metrics they want the Vercel Monitoring tools to track, including bandwidth and web traffic spikes and requests by bots that are indicative of a cyberattack. In total, there are more than 500 potential errors that developers can track. Logs then make it possible to drill down into errors and issues once they are identified to pinpoint the root cause of an issue.

As more responsibility for applications shifts left toward developers, there’s a clear need for tools that provide more visibility into the applications they develop. Many of the issues that DevOps teams encounter today could have been resolved if developers had been aware of them earlier.

The Vercel platform employs caching, routing and a React framework to optimize application performance in a way that reduces the dependency on backend infrastructure to optimize application performance. That approach puts less strain on backend infrastructure as more requests are automatically processed using a framework that spans clients and servers. In effect, developers can take advantage of frameworks such as React to treat the underlying IT infrastructure as if it were serverless whenever possible with tools that have a familiar JavaScript construct. The overall goal is to increase developer productivity at a time when many organizations are much more focused on the issue.

As a result, DevOps teams will need to make some adjustments as more applications capable of providing richer experiences are built and deployed without relying as much on backend infrastructure. That shift has implications for everything from the amount of network bandwidth consumed to the performance of web applications. Frameworks such as Next.js also tend to increase the overall rate at which web applications can be built and deployed.

One way or another, it’s clear that the way web applications are being built is fundamentally changing. The only issue now is determining to whether DevOps teams are prepared to absorb that level of change across an ever-increasing portfolio of applications that still need to be deployed, secured, updated and optimized.

February 28, 2023
Vercel Acquires Turborepo to Gain Build System

Vercel today announced it has acquired Turborepo, a provider of a build system for JavaScript and TypeScript applications that provides developers with access to an easy-to-use monorepository for their code.

In the wake of that acquisition, the command line interface (CLI) for accessing Turborepo will now be available under an open source license.

Jared Palmer, creator of Turborepo and other popular open source projects including Formik and TSDX, will continue working on accelerating Turborepo’s capabilities as the new leader of a build performance team at Vercel.

The goal is to move existing users of the Turborepo cloud service to a Vercel platform for building applications using the Next.js framework, which makes it possible to build web applications based on the React library for creating user interfaces that enable both static site generation (SSG) and server-side rendering (SSR).

Palmer said monrepositories such as Turborepo not only make it easier for developers to manage builds but also reduce the amount of time required to process those builds using a continuous integration/continuous delivery (CI/CD) platform.

Rival build systems are also much more complex to configure and manage, which Palmer said is a primary reason many developers have not yet set up their own mononrepositories.

As the number of applications that organizations want to build and deploy in the digital business transformation era increases, the focus on developer productivity is intensifying. Rather than having to maintain a complex build system, Turborepo is designed to be simple to configure. As a result, more developers can reduce build times by as much as 50%, noted Palmer.

In effect, front-end developers are able to more easily become full-stack developers by combining that build system with the Next.js framework, he added.

DevOps teams will need to adjust to applications capable of providing richer application experiences without relying as much on backend infrastructure. That shift has implications for everything from the amount of network bandwidth consumed to the performance of web applications. The Vercel platform employs caching, routing and a React framework to optimize application performance in a way that reduces the dependency on backend infrastructure to optimize application performance.

As web application development continues to evolve, the overall rate at which they web apps are built should increase significantly. Naturally, DevOps teams will need to consider the implications of having more applications move through DevOps pipelines and the need to continuously update those after they are deployed.

It’s not clear whether or how much DevOps teams will nudge developers toward frameworks such as Next.js to develop web applications that might not tax backend infrastructure as much as previous generations of applications. In effect, developers can take advantage of frameworks that enable them to treat the underlying IT infrastructure as if it were serverless whenever possible with tools that have a familiar JavaScript construct. Vercel claimed there are already more than 30,000 sites running Next.js in production at organizations like Airbnb, Hulu, Nike, Ticketmaster and Uber.

One way or another, it’s clear that the way web applications are being built is fundamentally changing. The only issue now is determining to what degree the rest of the IT organization is prepared to absorb that level of change.

December 9, 2021
Next.js 11 Accelerates Frontend Performance and Enables Instant Collaboration to Let Developers Build the Next Big Thing, Faster
Cross-platform innovations highlighted by Vercel and Google to audience of more than 50,000 attendees.

San Francisco, CA, June 15, 2021 — Vercel, a comprehensive platform for creating unsurpassed web user experiences and creator of Next.js, the leading React and JavaScript framework for frontend web development, today announced Next.js 11, accelerating frontend developers’ ability to build the next big thing through speed and collaboration. New innovations include significantly faster starts and changes, real-time feedback, instantaneous live collaboration and significant image optimization enhancements. In addition, the Aurora team in Google Chrome developed Conformance for Next.js, a system that provides carefully crafted solutions and rules to support optimal loading; Next.js script prioritization and font enhancement automations that reduce First and Largest Contentful Paint times. Together, these enhancements enable developers to improve Core Web Vitals scores, which are now being used by Google to influence search rankings. Developers can try these new capabilities by visiting nextjs.org/11.

Next.js is the first hybrid framework to succeed at scale, and the only one to meet the needs of both static and dynamic websites and applications. Leveraging React as the fundamental unit of collaboration gives developers at companies including TikTok, Hulu, Ticketmaster, Staples and Marvel the flexibility to scale from one page to one billion pages.

Since the first Next.js Conf in October 2020, Next.js open-source contributors have grown to more than 1,600, driving downloads on NPM from 4.1M to 6.2M. Traffic to all sites and apps on the Vercel edge network has doubled, weekly deploys have quadrupled and the number of homepages in the Alexa top 10,000 using Next.js have grown by 50%.

“Whether you’re starting with a single static page or deploying a dynamic site with billions of pages, Next.js is the hybrid framework that meets you where you are and grows with you,” said Vercel CEO Guillermo Rauch. “We believe the fastest and most enjoyable end-user experience must go hand in hand with the fastest and most enjoyable developer experience.”

New Innovations in Next.js 11 Include:
- The Fastest Frontend Platform Ever — Next.js innovations improve startup time by up to 24% and reduce processing time for changes from edit to screen by 40%.
- Next.js Live (Preview Release) — Combining a brand new dev server engine for Next.js with the Vercel platform enables teams to instantly share, chat, draw, and edit from anywhere in the world, with developers able to generate a URL in less than five seconds. With support for both static and dynamic Next.js applications, sharing and accessing a URL is always instantaneous, regardless of page numbers, because there’s no build process involved. Next.js will run entirely inside the web browser. Leveraging ServiceWorker, WebAssembly and ES Modules makes everything that’s possible when you run Next.js on a local machine possible in the context of a remote collaboration. Next.js Live works perfectly, even when offline, eliminating the need to run or operate remote virtual machines.
- Real-time Feedback — Vercel enables developers to see the reaction to changes instantly. A priority in Next.js since day one, the new functionality builds on support for webpack HMR with zero configuration, and on the close partnership with Facebook, which led to the development of the Fast Refresh innovation in Next.js. Now developers can run the next dev command and their frontend project is ready to go. The browser reflects changes as soon as a file is saved. This not only works for styles, but thanks to Fast Refresh, all state is preserved even as changes are made.
- Industry-first Image Enhancements — Next.js lets developers quickly swap the HTML image tag for the Next.js image component, optimizing images for each device viewport the image is delivered to. Lighthouse tests provide insights for improving loading performance out of the box in development when running Next Start, or when deploying to Vercel via its blazing fast edge network. Close community-driven integration with Cloudinary, Cloudflare, Akamai, and Imgix extend those benefits to the leading third-party content networks. New enhancements include support for the import keyword for the src, which can be used to refer to essential images that are part of a repository and automatically setting width and height parameters for local images, reducing cumulative layout shift, a core web vital. It also provides support for image placeholders on imported images, easing the transition from blank space to image, in addition to support for blurring for dynamic images.
- Conformance for Next.js — This new system provides carefully crafted solutions and rules to support optimal loading. It frees developers from having to memorize complicated rules for loading performance via a compiler that enforces best practices to ensure predictable outcomes. This makes teams productive, and becomes essential as teams grow and features increase.
- Next.js Script Component — This foundational optimization enables developers to set the loading priority of third-party scripts, significantly improving loading performance. Developers can now simply define the strategy property and Next.js will prioritize it. It enables three different loading strategies — before-interactive, for critical scripts such as security and authentication that need to be fetched and executed before the page is interactive; after-interactive, for scripts such as tag managers and analytics that can fetch and execute after the page is interactive; and lazy-onload, for scripts such as chat support widgets that can wait to load last during idle time.
- Font Enhancement Automations — More than 80% of web pages are using custom web fonts as part of their branding, design, or to maintain cross-browser and device consistency. That customization exacts a performance toll. In April, Google introduced Font Optimization that includes Google Fonts and Adobe Typekit on Next.js, along with Font Optimization for Angular for Google Fonts. In Next.js, the CSS of custom fonts is now automatically inlined at build time. This eliminates the round trip to fetch font declarations, improving both First and Largest Contentful Paint times by as much as five seconds. A preconnect tag in Next.js, by default, establishes a connection with the underlying font files even faster.
“At Google Chrome, we believe our collaboration with Next.js is an example of how to set predictable outcomes for loading performance,” said Houssein Djirdeh, developer advocate at Google. “We love working together with great frameworks to help developers make the web faster and we’re incredibly grateful for the maintainers and sponsors of the frameworks that enable the web to thrive. A special thanks to the Next.js team for testing with us and sharing the cost of many early attempts.”

About Vercel

Vercel is the leading advocate and enabler of frontend developer experience, having created the best platform to deploy any frontend website or application and Next.js, the most popular React framework. Vercel provides unsurpassed vertical integration, from developer experience to edge delivery, with the industry’s most advanced development tools paired with parallel compute in a serverless cloud environment providing a fully-managed, highly-automated experience for both developers and users. Companies including Carhartt, Github, Hulu, IBM, McDonald’s, Uber and Facebook deploy their frontends with the Vercel platform. Vercel (twitter @vercel) is headquartered in San Francisco.
June 15, 2021
Vercel Announces $40M in Series B Funding to Fuel Frontend Development Innovation

GV-led round will be used to accelerate adoption and expand hybrid platform for development and deployment of any dynamic website or application

SAN FRANCISCO – December 16, 2020 – Frontend development pioneer Vercel today announced that it has secured $40M in series B funding in a round led by GV, with participation from new investors Greenoaks Capital, Bedrock Capital and Geodesic Capital in addition to existing investors Accel and CRV. The new funding, which brings the total raised to $61M, will be used to accelerate research and development, drive platform innovation and scale its team globally to further accelerate frontend developers’ ability to enrich end users’ web experiences. Companies including AirBnb, Hashicorp and TripAdvisor deploy their frontends with the Vercel platform.

“We see a significant uptick in the number of global enterprises transitioning from cloud to serverless computing technologies,” said Tyson Clark, GV general partner. “This opens the door for companies like Vercel to transform the frontend development market. Vercel’s collaborative approach to interactive web applications is well-positioned to become the top choice for developing the websites over the next decade.”

Vercel provides a software development workflow and deployment platform that redefines how developers work, how they collaborate with lines of business and, most importantly, how their sites perform. The leading advocate and enabler of frontend developer experience and the creator of Next.js, the first hybrid framework to succeed at scale, Vercel uniquely satisfies the needs of both static and dynamic websites and applications. Hybrid applications give users all the capabilities and benefits of a static generator, while providing the flexibility of server-side rendering or streaming server-side rendering for additional personalization within the same application.

“Since our inception, Vercel has been focused on creating the most powerful way to develop, preview and ship interactive web applications without having to depend on monolithic backend systems,” said Guillermo Rauch, CEO of Vercel. “Vercel is now the preferred frontend development platform, capable of providing dynamic web application experiences for growing legions of Javascript developers. We are extremely pleased to have partnered with GV, whose experience in this space will help us grow as a company, rapidly expand our user base and ensure ever-higher quality of user experiences globally in the coming months.”

About Vercel

Vercel is the leading advocate and enabler of frontend developer experience, having created Next.js, the most popular React framework available, and Vercel, the best platform to build and deploy any frontend website or application. Vercel provides unsurpassed vertical integration, from developer experience to edge delivery, with the industry’s most advanced development tools paired with parallel compute in a serverless cloud environment providing a fully-managed, highly-automated experience for both developers and users. Companies including AirBnb, Hashicorp and TripAdvisor deploy their frontends with the Vercel platform. Venture-backed by Accel and CRV, Vercel (twitter@vercel) is headquartered in San Francisco.

December 16, 2020