Vercel starts binding dashboard logins to the device's TPM (Device Bound Session Credentials), so stolen session cookies can't be replayed elsewhere
Session-cookie theft has been behind many recent developer-platform compromises. If you run your own web apps, Chrome's DBSC is worth evaluating for admin consoles; meanwhile keep session lifetimes short for high-privilege dashboards and bind sensitive actions to fresh re-authentication.
Sources: BleepingComputer: Vercel rolls out new protection against stolen session cookie attacks (Nov 4)