Vercel Security Review is in public beta for Pro and Enterprise teams.

Every push to a connected GitHub repository is reviewed for vulnerabilities, including direct and force pushes to your production branch. Findings land in the Vulnerabilities dashboard with a suggested fix.

Vercel changelog: vercel.com/changelog/verc…

Vercel MCP now accepts Client ID Metadata Documents (CIMD) as OAuth client IDs.

MCP clients can connect without pre-registration or allowlisting.

Vercel changelog: vercel.com/changelog/verc…

Vercel Flags can now evaluate flags defined in another Vercel project, without sharing SDK keys.

Project Connections let one application read flags from a different project, which helps when several apps share the same rollout controls.

Vercel changelog: vercel.com/changelog/eval…

Vercel Sandbox with Drives now starts faster. Median creation time dropped from 1.7s to 0.7s, and p95 from 2.2s to 1.6s.

No SDK upgrade or config change is needed, and pricing stays the same.

Vercel changelog: vercel.com/changelog/verc…

Cloudflare's WAF can now correlate an HTTP request with its response.

Full transaction detection is meant to surface successful exploits, data exposure and risky misconfigurations that request-only inspection can miss.

Cloudflare's post: blog.cloudflare.com/full-transacti…

Cloudflare cut full DNS zone builds by 40%, peak memory by 85%, and halved build delay.

The fix: a planner that picks the smallest safe build when a zone setting changes, instead of rebuilding the whole zone, even ones with tens of millions of records.

Cloudflare's write-up: blog.cloudflare.com/dns-targeted-z…

Complex projects usually fail at the seams between teams, vendors and stakeholders, not inside any one codebase.

A big part of delivery is coordinating the technical side so everyone stays aligned and risks surface early.

How we approach delivery: 8zero7.com/services

Build in public: every Monday the AI agent that runs ToolTier for us re-reads the official pricing page of every tool we rank.

This week it checked 146 tools and re-verified 137. No list price changed, and none of the changes moved a tool's tier.

This week's check: tooltier.dev/blog/ai-tool-p…

Vercel projects can now be configured with vercel.toml, using the same properties as vercel.json.

One rule: use only one project configuration file at a time, either vercel.toml, vercel.json or vercel.ts.

Vercel changelog: vercel.com/changelog/proj…

Vercel now checks for blocked npm packages before and during dependency install, on all plans with no configuration.

It checks supported lockfiles, including dependencies restored from the build cache. If a blocked version is found, the deployment fails and names the package.

Vercel changelog: vercel.com/changelog/bloc…