Vercel Security Dashboard reaches general availability with agent-ready CLI checks

A single view of security posture

Vercel has moved its Security Dashboard to general availability, opening the feature up to customers on every plan rather than a limited tier. According to the Vercel blog post announcing the change, the dashboard gives developers one place to assess the security posture of every account and project connected to their setup.

Vercel frames the tool as a response to how development practices have shifted. As organisations grow and coding agents make it quicker to spin up new projects, configuration mistakes tend to accumulate without anyone noticing. The dashboard is meant to catch that drift before it becomes a real exposure.

What gets flagged

According to Vercel, the dashboard automatically detects several categories of common misconfiguration:

• Team members who have not turned on two-factor authentication
• Long-lived credentials such as static tokens that could be replaced with OIDC federation
• Preview deployments that are publicly accessible
• Environment variables that are stale or not marked as sensitive

In the dashboard UI, findings are ranked by risk with the most severe shown first, and each one links directly to the settings screen where the fix lives. Findings that a team considers irrelevant noise can be muted, and the complete set of results can be exported to a CSV file for triage or reporting.

The same checks in the terminal

Alongside the UI, Vercel shipped a matching Vercel CLI command, vercel security check, which runs the identical set of checks and prints the detected misconfigurations in the terminal.

The command is designed with automated agents in mind. An agent can run vercel security check --findings to read which checks failed, apply the corresponding fix, and re-run the command to confirm the issue is resolved. Vercel lists the remediations an agent can carry out this way: enabling Git fork protection, marking an environment variable as sensitive, and replacing a static credential with OIDC federation.

The check can also be scoped to a single project with a --project flag when a narrow change set is wanted. In CI pipelines and other non-interactive environments, the command writes its report to stdout as JSON automatically, so agents receive structured output without needing extra flags.

Why it matters

Two things lift this beyond a routine feature launch. First, posture-checking tooling of this kind is often reserved for enterprise plans; by shipping it to all tiers, Vercel puts baseline security auditing in reach of small teams and individual developers, not just large organisations.

Second, the design leans directly into the rise of agentic development. Rather than treating the dashboard as something a human reviews and then fixes by hand, Vercel exposes findings as structured CLI output paired with remediations a machine can apply and verify in a loop. As coding agents take on more of the day-to-day work of creating and configuring projects, that pattern — scan, fix, re-check, all without a human in the middle — is likely to become a standard expectation for security tooling rather than a novelty.