--- title: "Vercel Security Review, Tracing GA and Claude IP allowlist" description: "Vercel and Claude news, 2 to 8 Nov 2026: Security Review is no longer free, Tracing is GA with longer retention, the Claude Console gets an IP allowlist." canonical_url: "https://www.outofplace.space/blog/dev-digest-2026-11-08" language: "en" last_updated: "2026-11-11" alternates: pl: "https://www.outofplace.space/pl/blog/nowosci-vercel-security-review-tracing-2026-11-08.md" --- # Vercel Security Review, Tracing GA and Claude IP allowlist > Vercel and Claude news, 2 to 8 Nov 2026: Security Review is no longer free, Tracing is GA with longer retention, the Claude Console gets an IP allowlist. Published 2026-11-11 · Category: Vercel & AI SDK · Tags: Security, Claude, AI SDK, AI agents This week Vercel shipped a security scanner and made tracing generally available, and Anthropic gave Claude organisations two new access controls. [Vercel Security Review](https://vercel.com/blog/vercel-security-review), a public beta for Pro and Enterprise teams, reviewed pushes for free until 10 November 2026 and is now billed at the Vercel Agent rate; it is worth turning on for one project to see what it finds in your next pushes and what they cost. Note that it is a scanner, not a patch: a framework vulnerability still needs an upgrade, as with the [Next.js 16.4.5 security release](https://www.outofplace.space/blog/nextjs-16-4-5-security-release) of 3 November. The rest needs a decision rather than an upgrade: whether Tracing's new default of 100% sampling suits a busy app, whether your Claude traffic leaves from addresses you can put on an IP allowlist, and which way Token Pass should fail when its credit runs out. | Item | Version or date | What to do | | --------------------------------------- | ----------------------------- | ----------------------------------------------------------- | | Vercel Security Review (beta) | 2 Nov, billed after 10 Nov | Try it on one project, with one policy for your auth rules | | Vercel Tracing GA | 6 Nov | Check sampling rules on busy projects | | Projects that expire | Vercel CLI 65.12.0, 6 Nov | Add the flag to throwaway and agent deploys | | json-render for Chat SDK | 6 Nov | Pass `limits` and return `CardSpecError` to the model | | DeepSeek V4.1 Flash 1017 Ultrafast | 7 Nov, public preview | Use it where latency matters, with a fallback model | | DeepSeek Search and Fetch tools | AI SDK 6.0.321 or 7.0.160 | Handle the search fallback in code if you need an order | | Token Pass credit applies automatically | 6 Nov, Pro | Choose a hard stop or a paid fallback | | Claude Console IP allowlist (beta) | 5 Nov | List every egress IP first, keep the admin way back in | | Sign a member out everywhere (beta) | 5 Nov, Claude Enterprise | Add it to your lost-device runbook, with key revocation | | Tailwind CSS 4.3.4 and 4.3.5 | 2 and 6 Nov | Upgrade; drop `as: '*.css'` from the Turbopack loader | ## Vercel ### Vercel Security Review scans every push, now at the Agent rate On 2 November 2026 Vercel announced Security Review, a new capability of Vercel Agent next to Code Review and Investigation. Once enabled in Vercel Agent settings, for all projects or selected ones, it reviews every push to the team's connected GitHub repositories, including direct pushes to the production branch. It reviews only what changed against a base (for a deployment, the branch's previous deployment), reading the diff along with the surrounding code; it traces whether the code is reachable, checks existing protections and rechecks each finding before reporting it. Findings go to the Security dashboard and the CLI; on private and internal repositories it also adds a GitHub check and comments on pull requests. Teams can write security policies in plain language and manage them with `vercel security policy`. Reviews were free until 10 November 2026 and since then are billed at the Vercel Agent rate: the provider's token price with no markup plus $0.25 per million tokens. It covers code pushed to GitHub only; Vercel CLI and v0 deployments are planned. Our take: worth trying on a Pro team even now that it costs tokens; start with one busy project and read the first bill. Because each review covers only what changed, don't count on it to find the missing auth check that has been in your code for a year; it is built for the one added next week. The best use is a policy that says what a reviewer always forgets, such as "every route under `/api/admin` checks the session's role", so each push is held to it. ### Vercel Tracing is generally available, with longer retention Vercel's changelog of 6 November 2026 makes [Vercel Tracing generally available](https://vercel.com/changelog/vercel-tracing-is-now-generally-available) on all plans, at beta pricing. A new Traces page lists every trace and span of a project or the whole team, with filters, a Live mode and search in Kibana Query Language (KQL), the same queries as `vercel traces search --query` in the CLI. Retention now depends on the plan, not on log retention: 3 days on Hobby (1 hour in the beta), 14 days on Pro (1 day) and 14 days on Enterprise (3 days). New projects on Next.js 16.5 with at least one Node.js function get tracing after their first successful build, with a sampling rule that traces 100% of requests in every environment; removing all sampling rules in Settings → Tracing turns it off. Our take: the retention is the real change. A trace that lived a day on Pro was gone by Monday; 14 days lets you look back at an incident after the fact. The changelog sets the 100% default for new projects on Next.js 16.5 and says nothing about existing ones. When you start a busy project on 16.5, decide whether 100% of preview and production traffic is what you want to collect, since the [Tracing docs](https://vercel.com/docs/tracing) say sampling decides what is kept, one whole trace at a time. ### Vercel CLI can create projects that delete themselves Since 6 November 2026 [`vercel deploy --delete-project-after`](https://vercel.com/changelog/vercel-cli-can-now-set-new-projects-to-expire) gives a new project an expiry of `1h`, `1d`, `1w`, `2w` or `30d`, and Vercel deletes the project when it expires. It needs Vercel CLI 65.12.0 or later, prints the expiry date, and works only when that deploy creates the project: on an existing project the expiry doesn't change and the CLI warns. `vercel project keep my-project` removes the expiry. Our take: this is for the projects nobody remembers to delete: prototypes, demos for one call, and above all the projects your coding agent creates. Put the flag in the agent's deploy instructions and the team's project list cleans itself up. The deletion is the point, so run `vercel project keep` the moment a prototype becomes something you want. ### Chat SDK agents stream generative UI with json-render On 6 November 2026 Vercel showed how a [Chat SDK agent streams generative UI with json-render](https://vercel.com/changelog/json-render-and-chat-sdk-agents). The model writes a JSON spec from a typed catalog of components (tables, charts, buttons), `@json-render/chat` turns it into a Chat SDK card, and each platform's adapter posts the card in its own format, such as Block Kit on Slack or Adaptive Cards on Teams. `streamCard` posts the card once its root element has content and by default updates it at most every 500 ms; `toCard` checks each element's props against its schema and throws `CardSpecError` with the list of problems. Platforms cap what one message holds and adapters degrade what exceeds it (Slack turns a second table into a code block); passing `limits` rejects such a spec instead. Our take: pass `limits`. A table that silently becomes a code block in Slack is a bug nobody reports; a rejected spec is one you can fix. Send `CardSpecError`'s list back to the model and let it retry, which is what the error is built for. If your chat lives in a web app rather than in Slack or Teams, [streaming with `useChat`](https://www.outofplace.space/blog/vercel-ai-sdk-usechat-streaming) is the closer fit. ## AI Gateway ### DeepSeek V4.1 Flash 1017 Ultrafast: speed at about 33 times the output price On 7 November 2026 AI Gateway added [DeepSeek V4.1 Flash 1017 Ultrafast](https://vercel.com/changelog/deepseek-v4-1-flash-1017-ultrafast-now-available-on-ai-gateway) (`deepseek/deepseek-v4.1-flash-1017-ultrafast`), the 17 October update of DeepSeek V4.1 Flash served on Fireworks' accelerated endpoint at, per Vercel, more than 1,000 tokens per second, with a 1M-token context window. It is in public preview, with no waitroom or session time limit. As of 11 November 2026 its [model page](https://vercel.com/ai-gateway/models/deepseek-v4.1-flash-1017-ultrafast) lists $2.40 per million input tokens and $9.60 per million output tokens, while the standard [DeepSeek V4.1 Flash 1017](https://vercel.com/ai-gateway/models/deepseek-v4.1-flash-1017) starts at $0.29 per million output tokens across 24 providers. Our take: the same model at about 33 times the cheapest standard output price is worth it only where a person waits for each token, such as an agent's edit loop or a chat answer. Keep batch jobs and background work on the standard ID. The Ultrafast version runs on one provider in preview, so give it the standard model as a fallback. ### AI Gateway adds DeepSeek Search and Fetch tools Since 6 November 2026 AI Gateway offers [DeepSeek Search and DeepSeek Fetch](https://vercel.com/changelog/ai-gateway-adds-deepseek-search-and-fetch-tools) as tools for any model that supports tool calling, through one AI Gateway key: `gateway.tools.deepseekSearch({ count })` returns pages with titles, URLs and summaries, `gateway.tools.deepseekFetch()` returns a page as Markdown. They need AI SDK 6.0.321 or later on v6, or 7.0.160 or later on v7. Each costs $0.75 per 1,000 billable requests, model tokens extra; failed requests, timeouts and empty results cost nothing. Fetch reads result URLs from the Exa and Parallel search tools too, but falling back from one search tool to another is up to the model: Vercel calls provider order and retry limits "best effort". Our take: Fetch is the useful half, since any search result becomes Markdown the model can read without your own scraper. If you need a fixed order of search providers, catch the failure in your code rather than trusting the system prompt. And treat fetched pages as untrusted input: an agent that reads the web shouldn't hold a tool that writes or spends money without your approval. ### Token Pass credit now applies to every AI Gateway key Vercel's changelog of 6 November 2026 makes [Token Pass credit apply automatically](https://vercel.com/changelog/token-pass-credit-now-applies-automatically-across-ai-gateway) to included model usage, whether a request uses an API key, an OIDC token or fx login; a dedicated Token Pass key is no longer required. When the credit runs out for the billing period, standard keys and OIDC tokens fall back to the team's AI Gateway credits, while Token Pass keys stop until the next period. Requests through the Token Pass provider stay Zero Data Retention (ZDR); fallback requests follow the team's ZDR setting. It is available to Token Pass subscribers on Pro teams. Our take: the key you use now decides how your app fails. A Token Pass key gives a hard stop, a standard key keeps serving and bills your credits. Pick on purpose, and if your app relies on ZDR, turn on team-wide ZDR before the fallback starts routing your requests. ## Claude ### The Claude Console gets an IP allowlist The [Claude release notes](https://platform.claude.com/docs/en/release-notes/overview) of 5 November 2026 add an IP allowlist for Claude Console organisations, in beta. Per the [IP allowlisting docs](https://platform.claude.com/docs/en/manage-claude/ip-allowlist), an admin or owner adds up to 1,000 IPv4 or IPv6 addresses or CIDR ranges (no broader than `/8` and `/32`) on the Identity and access page. It covers the Console itself, the Messages, Batches, Token Counting, Models, Files and Skills endpoints, the Claude Managed Agents endpoints, and the Admin and Compliance APIs. A request from outside the list gets a 403 `permission_error`. Claude in Amazon Bedrock, Claude Platform on AWS, Claude Models on Google Cloud and Claude in Microsoft Foundry aren't covered. Changes take up to 15 minutes, and Anthropic recommends keeping the option that lets admins reach the settings page from any address. Our take: on Vercel this works only with fixed egress. Vercel Functions leave from changing addresses unless the project has [Vercel Static IPs](https://vercel.com/docs/networking/static-ips), $100 a month per project on Pro plus Private Data Transfer as of 11 November 2026; Routing Middleware never uses them, and builds do only when you turn it on. Without that, rely on what Anthropic recommends alongside the allowlist: a short key expiry or Workload Identity Federation. Before you save, list CI and the jobs that run weekly; they fail with a 403 days later. ### Sign a Claude Enterprise member out everywhere The same release notes add a beta Admin API call that signs a Claude Enterprise member out of Claude everywhere. Per the [user management docs](https://platform.claude.com/docs/en/manage-claude/user-management#sign-a-member-out-everywhere), `POST /v1/organizations/users/{user_id}/sign_out` needs the `write:members` scope and the `anthropic-beta: admin-user-sign-out-2026-10-08` header. It ends the member's sign-in sessions on every device, their trusted devices and the OAuth tokens issued for that organisation, such as Claude Code's. It doesn't end API keys (Admin API keys the member created included), Claude Code cloud sessions and routines, computers linked to Cowork, or OAuth tokens of other organisations. The member keeps their seat and can sign in again right away; the primary owner can't be signed out. Our take: for a lost laptop this is step one, not the runbook. Revoke the member's API keys and stop their cloud sessions in the same incident, because both keep working. And since the person can sign straight back in, a stolen account needs its credentials reset at your identity provider too. ## Tailwind CSS ### Tailwind CSS 4.3.4 and 4.3.5: a Turbopack loader, then a fix to its docs [Tailwind CSS 4.3.4](https://github.com/tailwindlabs/tailwindcss/releases/tag/v4.3.4), released on 2 November 2026, lists a new `@tailwindcss/turbopack` loader for Next.js among more than forty fixes, including rebuilds in Turbopack and webpack when the input CSS changes, and standalone macOS binaries that launch on macOS 27. [Tailwind CSS 4.3.5](https://github.com/tailwindlabs/tailwindcss/releases/tag/v4.3.5) followed on 6 November with seven fixes: `color-mix()` without an interpolation method no longer crashes, the WASM build no longer hangs in WebContainers, and the `as: '*.css'` setting is gone from the `@tailwindcss/turbopack` README because it broke CSS modules. Our take: if you set up the Turbopack loader from the 4.3.4 README in the last four days, remove `as: '*.css'` from your config and upgrade to 4.3.5. Otherwise both are safe patch upgrades. ## Further reading - [Vercel: Introducing Vercel Security Review](https://vercel.com/blog/vercel-security-review): What the scanner reviews, where findings appear, the beta's plans and pricing after 10 November 2026. - [Vercel: Tracing is now generally available](https://vercel.com/changelog/vercel-tracing-is-now-generally-available): The Traces page, KQL search in the CLI, retention by plan and the default for new Next.js 16.5 projects. - [Claude docs: IP allowlisting](https://platform.claude.com/docs/en/manage-claude/ip-allowlist): What the allowlist covers, entry format, how to avoid locking yourself out.