Guillermo Rauch @rauchg

So excited about this. We're rolling out a mechanism that protects Vercel customers even in a Binance-style attack, where your engineers get targeted with infostealer malware. With DBSC, renewing a session requires a key bound to your device, which means stolen cookies can't be practically re-used from remote Command & Control (C2) infrastructure. While this is a pretty major win, there's no silver bullet in security. Make sure your Vercel account has MFA enabled (both app-based TOTP and passkeys), your organization enables SAML / directory sync, your endpoints are protected, etc. (and stay paranoid!) [引用 @cramforce]: Today we are starting the rollout of Device Bound Session Credentials (DBSC) for vercel.​com DBSC makes it impossible to steal session cookies from a device. So, if you install info-stealer malware (e.g. through a supply chain attack), that malware can not steal your vercel.​com session. Malware can still do bad things while residing on the device. But the abuse we are seeing in practice separa…