---
title: Vercel starts binding dashboard logins to the device's TPM (Device Bound Session Credentials), so stolen session cookies can't be replayed elsewhere | ctxsec
url: https://ctxsec.com/items/vercel-device-bound-session-credentials-dbsc-dpop-cli
description: "Vercel is gradually rolling out Device Bound Session Credentials for vercel.com: a non-exportable private key in the device's TPM signs the session, so a cookie stolen by infostealer malware can't be refreshed on another machine. It works in Chrome on macOS and Windows for now, with a phased rollout to handle OAuth-app edge cases. Vercel is adding a similar protection, DPoP, to its CLI, and launched an AI 'Security Review' for code pushes in public beta for Pro and Enterprise teams."
status: "official (Vercel CTO Malte Ubl announcement on X, Nov 4, as reported by BleepingComputer)"
published: 2026-11-04
---

> Vercel is gradually rolling out Device Bound Session Credentials for vercel.com: a non-exportable private key in the device's TPM signs the session, so a cookie stolen by infostealer malware can't be refreshed on another machine. It works in Chrome on macOS and Windows for now, with a phased rollout to handle OAuth-app edge cases. Vercel is adding a similar protection, DPoP, to its CLI, and launched an AI 'Security Review' for code pushes in public beta for Pro and Enterprise teams.

[← Industry News](/industry) · [markdown](/items/vercel-device-bound-session-credentials-dbsc-dpop-cli.md)

official (Vercel CTO Malte Ubl announcement on X, Nov 4, as reported by BleepingComputer)

2026-11-04

### Vercel starts binding dashboard logins to the device's TPM (Device Bound Session Credentials), so stolen session cookies can't be replayed elsewhere

Session-cookie theft has been behind many recent developer-platform compromises. If you run your own web apps, Chrome's DBSC is worth evaluating for admin consoles; meanwhile keep session lifetimes short for high-privilege dashboards and bind sensitive actions to fresh re-authentication.

Sources: [BleepingComputer: Vercel rolls out new protection against stolen session cookie attacks (Nov 4)](https://www.bleepingcomputer.com/news/security/vercel-rolls-out-new-protection-against-stolen-session-cookie-attacks/)