---
type: "post"
id: "vercel-security-review-no-longer-requires-a-vercel-ec5e96"
slug: "vercel-security-review-no-longer-requires-a-vercel-ec5e96"
title: "Vercel Security Review no longer requires a Vercel project to scan your GitHub repos."
description: "Vercel Security Review can now inspect code changes in GitHub repositories that are not linked to a Vercel project."
retrieval_nugget: "Vercel Security Review can now inspect code changes in GitHub repositories that are not linked to a Vercel project. Covered repositories receive an automatic review on every push once the feature is enabled, extending Vercel’s vulnerability-review workflow to codebases without a Vercel deployment."
published_at: "2026-11-13"
updated_at: "2026-11-13"
record_date: "2026-11-13"
date_kind: "published_at"
topics: ["github"]
entities: ["Vercel","Vercel Security Review","GitHub","Vercel Agent"]
related_patterns: ["verification-bandwidth-is-the-scarce-resource"]
novelty_label: "new_fact"
what_changed: "Vercel Security Review can now scan GitHub repositories without a linked Vercel project, triggering reviews on pushes to covered repositories."
prior_refs: []
source_url: "https://vercel.com/changelog/vercel-security-review-no-longer-requires-a-linked-vercel-project"
source_urls: ["https://vercel.com/changelog/vercel-security-review-no-longer-requires-a-linked-vercel-project"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:vercel-security-review-no-longer-requires-a-vercel-ec5e96"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/vercel-security-review-no-longer-requires-a-vercel-ec5e96/","markdown":"https://newruntime.com/posts/vercel-security-review-no-longer-requires-a-vercel-ec5e96.md","json":"https://newruntime.com/posts/vercel-security-review-no-longer-requires-a-vercel-ec5e96.json"}
markdown_url: "https://newruntime.com/posts/vercel-security-review-no-longer-requires-a-vercel-ec5e96.md"
---

# Vercel Security Review no longer requires a Vercel project to scan your GitHub repos.

## Retrieval answer

Vercel Security Review can now inspect code changes in GitHub repositories that are not linked to a Vercel project. Covered repositories receive an automatic review on every push once the feature is enabled, extending Vercel’s vulnerability-review workflow to codebases without a Vercel deployment.

## Summary
Vercel Security Review can now inspect code changes in GitHub repositories that are not linked to a Vercel project. Covered repositories receive an automatic review on every push once the feature is enabled, extending Vercel’s vulnerability-review workflow to codebases without a Vercel deployment.

## What happened
Vercel’s changelog announcement says that Security Review can scan code changes for vulnerabilities in GitHub repositories that have not yet been linked to a Vercel project. The change removes a setup dependency: a team no longer needs to create or link a Vercel project before Security Review can inspect commits in an eligible repository. Vercel says the review checks commits directly in repositories where Security Review is enabled, without requiring either a project or a deployment.

The default scope is broad. According to Vercel, Security Review covers all unlinked repositories that the Vercel GitHub App can access within a connected GitHub account. That is a default, not an irreversible setting. Teams can restrict coverage in Agent settings, either to selected connected accounts or to individual repositories. The practical consequence is that a team connecting an account should review the GitHub App’s existing access and deliberately choose the repositories that should receive automated reviews.

The trigger is also explicit. Once Security Review is enabled for a covered repository, every push automatically triggers a review of that repository’s code changes. Vercel does not describe this as a deployment-based workflow for unlinked repositories: commits are checked directly. This permits review activity on code that does not pass through a Vercel deployment path, including repositories that a team hosts or ships elsewhere.

Vercel distinguishes the newly expanded path from the existing linked-project path. When a push creates a deployment for a linked Vercel project with Security Review enabled, the review uses additional project and deployment context. The announcement does not specify what that extra context contains, how it changes findings, or whether it affects review quality. It establishes only that linked-project reviews can use context unavailable to the direct repository path.

To enable the feature, Vercel instructs teams to connect the relevant account in the team’s Git settings and then enable Security Review in Vercel Agent settings. The company links to its Security Review documentation for setup details. The announcement does not state a plan requirement, price, supported-language list, review-time target, or limit on findings. Those operational details cannot be assumed from the change in repository eligibility.

## What the archive adds
New Runtime’s earlier coverage on November 4 reported that Vercel CI could work with private GitHub repositories without creating or linking a Vercel project ([earlier coverage](https://newruntime.com/posts/vercel-ci-now-works-on-github-repos-without-1e5c49/)). This is a new feature change on the same integration boundary: Vercel now removes the project-link requirement for automated Security Review as well as CI.

## Trend signal
This supports the assumption that automated evidence such as security scans can help teams accept agent changes without line-by-line human review ([verification ownership](https://newruntime.com/shifts/verification-ownership/)). The important qualification is that Vercel has expanded when a scan runs and where it can run; it has not shown that its findings alone are sufficient evidence to approve a change.

## Why now
Vercel’s announcement frames the change as an extension of the GitHub connection already used by its product. Repositories visible to the Vercel GitHub App can now enter the review workflow without first being represented as Vercel projects. That removes an administrative step for teams whose repository inventory is broader than their Vercel deployment inventory.

## Connections to other events
New Runtime’s November 4 note on Vercel CI described private GitHub repositories working without a linked Vercel project ([earlier coverage](https://newruntime.com/posts/vercel-ci-now-works-on-github-repos-without-1e5c49/)). Both updates move Vercel capabilities closer to the Git repository itself rather than making project creation the required entry point. This release applies that approach specifically to vulnerability review triggered by pushes.

## Why it matters
Teams rarely keep all code in one hosting and deployment arrangement. Shared libraries, internal services, migration repositories, and tools maintained by another group may live in GitHub but have no reason to be deployed through Vercel. Previously, a project-link requirement could make those repositories ineligible for this review workflow or encourage teams to create configuration solely to gain access.

The new option lets a team evaluate Security Review across that broader repository inventory while keeping repository selection under its control. It should not be treated as a blanket approval mechanism. The default coverage can include every unlinked repository accessible to the Vercel GitHub App, making scoping and access review important before enablement. Teams also need an owner for findings and a clear decision on whether results are informational, part of pull-request review, or tied to a separate remediation process.

For teams using coding agents, the change can add another automated signal around code changes that agents produce. That is useful only if the organization can verify and act on the signal. Tests, dependency controls, human triage, and security policy still determine whether a reported issue is understood and resolved.

## Limits and uncertainty
Vercel does not quantify detection quality, false-positive rates, supported languages, review latency, or pricing in its announcement. It also does not say whether findings can block a merge, how results are presented to developers, or how the direct repository review compares with a review that has linked-project and deployment context. The default scope depends on repositories the Vercel GitHub App can access, but the announcement does not independently demonstrate the feature’s performance across those repositories.

## Skill to build now
Inventory the repositories reachable by the Vercel GitHub App before enabling Security Review broadly. Select a small set of non-Vercel repositories, make a controlled change, and document who receives findings, how they are triaged, and what evidence is required before a change is accepted. This turns an automatic push trigger into a review loop rather than an unattended stream of alerts.

## Reader takeaway
Security Review no longer requires a Vercel project: it can review pushes directly in eligible GitHub repositories. The immediate opportunity is to cover codebases outside Vercel deployments, while the immediate discipline is to scope GitHub access and validate how useful the reviews are in the team’s existing security process.

## Open question
How does Security Review’s detection quality on unlinked repositories compare with reviews that can use linked project and deployment context?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)