Vercel's security checks now run in CI as a JSON-emitting CLI, so frontend teams automate 2FA, OIDC, and env-var cleanup instead of clicking through a dashboard.
Vercel shipped its Security Dashboard as generally available on all plans, and the part that should change how you work is the CLI, not the dashboard. vercel security check outputs JSON to stdout, so you can drop security hardening into CI and let it run on every deploy. That is the workflow change: remediation stops being a scheduled manual audit and becomes a gate your pipeline fails on.
The dashboard itself is a unified view across accounts and projects, with issues ranked by risk. It flags team members without two-factor authentication, long-lived credentials you can swap for OIDC, stale or non-sensitive environment variables, and preview deployments left exposed.
The agent-driven framing is worth taking seriously. As AI agents increasingly own deploy workflows, giving them a structured security check that emits JSON is more useful than a set of charts a human has to interpret. You get the same posture data the dashboard shows, in a shape a script can act on.
If you are not auditing your Vercel org today, this is a cheap habit to start. Wire the check into CI this week, fix whatever it surfaces by risk rank, and keep it there. The dashboard is nice; the gate is the point.
Vite+ Beta bundles Vite 7, a runtime, and a package manager into a single workflow with smart caching and a migration CLI, targeting teams tired of stitching together separate build, run, and dependency tools.
1 source
A coordinated campaign injected malicious code into 14 widely-used npm packages last week. We break down the affected packages, detection steps for your lockfile, and the one CI flag that catches this.
1 source
Vercel shipped Next.js 16.2 with sub-second dev startup, 350% faster RSC payloads via V8 JSON optimizations, and AGENTS.md auto-scaffolding that gives coding agents version-matched project documentation.
1 source