How do you catch vulnerabilities on direct pushes to production?

Direct and force pushes to production branches bypass PR-based security checks, leaving real coverage gaps. Vercel Security Review, now in public beta for Pro and Enterprise teams, runs automatically on every push to a connected GitHub repository and reports findings in the Vulnerabilities dashboard.

What it is

Security Review is an automated source code vulnerability scanner that triggers on push events rather than pull requests, so direct and force pushes to production branches are reviewed too. Each finding records the project, environment, branch, and commit, with a summary, a suggested fix, and an AI-generated severity rating.

• Adds a GitHub check to each reviewed commit
• Posts findings as PR review comments linking back to each finding
• Every project affected by a single push is reviewed together

Applied case

A team member force pushes directly to the production branch, bypassing the usual PR review flow. Security Review still triggers on that push event, analyzes the affected projects, and surfaces a finding with severity rating and suggested fix in the dashboard. The developer clicks Fix with Vercel Agent, which proposes a fix and opens a PR that merges only after approval. Alternatively they run vercel security vulnerabilities in the Vercel CLI to let their own coding agent handle it.

• Fix with Vercel Agent opens a PR; nothing merges until you approve it
• No agent? Copy any finding as Markdown or JSON to feed your own tools

Read more

Security Review changelog

Security Review docs