Vercel is making a stolen login cookie worthless on any other machine.

BleepingComputer reports Vercel is gradually rolling out Device Bound Session Credentials for vercel.com logins: a private key in the device TPM signs the session cookie, so a cookie stolen by infostealer malware cannot be replayed on another machine. It works in Chrome on macOS and Windows, and Vercel is adding a similar protection, DPoP, to its CLI.

A stolen session cookie skips the password and the second factor. Your deploy platform holds environment variables and production access, so one infected laptop used to be enough.

Use Chrome on macOS or Windows for Vercel logins so you get the protection as it rolls out. Keep sensitive environment variables marked sensitive, and sign out of stale sessions.