Vercel Security Review no longer requires a linked Vercel project

Vercel Security Review now scans code changes for vulnerabilities in GitHub repositories even if they are not linked to a Vercel project. The feature automatically covers all unlinked repositories the Vercel GitHub App can access in a connected GitHub account by default. Users can restrict coverage to specific accounts or repositories through Agent settings. This change expands Security Review’s reach without requiring prior project setup.

Once enabled, Security Review triggers a review of code changes with every push to a covered repository. The scans operate directly on commits within repositories where Security Review is active, eliminating the need for a linked Vercel project or deployment. This allows developers to assess vulnerabilities earlier in the development cycle, before deployment occurs.

When a push also creates a deployment for a linked project with Security Review enabled, the review incorporates additional context from the project and deployment. This provides deeper insights for projects already integrated with Vercel, while maintaining the flexibility to scan unlinked repositories independently.

To activate Security Review, users must first connect their GitHub account in their team’s Git settings. Afterward, Security Review can be enabled in Vercel Agent settings. Documentation is available to guide users through the setup process and clarify how the feature operates across different repository types.