Vercel bug bounty programs
vercel.com Updated
Vercel runs 4 public programs on HackerOne and Sorona; 4 pay cash, the most up to $10,000 (Vercel). It also owns nextjs.org, which runs one more program.
- Top reward
- $10,000
- HackerOne
- Programs
- 5
- 5 pay cash
- Targets in scope
- 48
- 4 types, deduplicated
- Last change
- 30 Sep 2026
- 1 month ago
Where to report
4 programs Vercel runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Vercel
HackerOne · The company-wide program. Pays up to $10,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Vercel
HackerOne · Bug bounty |
$10k | $5,000 | $1,750 | $500 | $10,000 | – | – | 1 hour average | Open |
|
Vercel CLI
Sorona · Bug bounty |
– | $6,000 | $1,250 | $625 | $6,000 | Partial | – | 24 hours promised | Open |
|
Vercel Sandbox
HackerOne · Bug bounty |
$50k (highest) | $25k (highest) | $10k (highest) | $5,000 (highest) | $50,000 | – | – | 35 hours average | Paused |
|
Vercel Open Source
HackerOne · Bug bounty |
$10k | $5,000 | $1,000 | $500 | $10,000 | – | – | 2 hours average | Paused |
-
- Critical
- $10k
- High
- $5,000
- Medium
- $1,750
- Low
- $500
- First response
- 1 hour average
-
- Critical
- –
- High
- $6,000
- Medium
- $1,250
- Low
- $625
- Safe harbor
- Partial
- First response
- 24 hours promised
-
- Critical
- $50k (highest)
- High
- $25k (highest)
- Medium
- $10k (highest)
- Low
- $5,000 (highest)
- First response
- 35 hours average
-
- Critical
- $10k
- High
- $5,000
- Medium
- $1,000
- Low
- $500
- First response
- 2 hours average
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Vercel owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
48 targets across all 5 programs, each listed once with the programs that cover it. 15 excluded.
-
https://github.com/vercel-labs/agent-skills
Source code Critical
Covered by Vercel, Vercel Open Source
-
Authentication and credential handling in the CLI: login, token issuance, the on-disk global configuration and its permissions, and what ends up in terminal output or a CI log
Products and areas
Covered by Vercel CLI
-
File collection and upload during a deploy, including .vercelignore handling and whatever else decides which files leave the machine
Products and areas
Covered by Vercel CLI
-
Framework detection and vercel.json parsing, covering the routing, rewrite and header configuration a project can declare
Products and areas
Covered by Vercel CLI
-
Middleware and the Edge runtime, including the internal headers Next.js uses to talk to itself across that boundary
Products and areas
Covered by Next.js
-
Project and team scoping in the CLI and its API client, the boundary between one team's resources and another's
Products and areas
Covered by Vercel CLI
-
React Server Components, Server Actions and the Flight protocol: serialization and deserialization, action-id handling, CSRF protection and what a payload carries across the server boundary
Products and areas
Covered by Next.js
-
Request handling in the Node and Edge servers: Host and forwarded-header trust, cookie parsing, redirect targets, draft mode and the preview cookie
Products and areas
Covered by Next.js
-
Route Handlers, API routes and the server-side data-fetching entry points such as getServerSideProps and getStaticProps that run application code on a request
Products and areas
Covered by Next.js
-
Static and asset serving out of public/ and _next/static, plus source maps and anything else a production build leaves reachable
Products and areas
Covered by Next.js
-
The builder and build-utils packages this monorepo publishes, which exist to execute untrusted project code, along with the runtime shims they emit
Products and areas
Covered by Vercel CLI
-
The built-in image optimizer, its remote-pattern allowlist and the decoding it performs on whatever it fetches
Products and areas
Covered by Next.js
-
The environment-variable commands and the secrets they write to disk
Products and areas
Covered by Vercel CLI
-
The routing layer across both routers: dynamic segments, route groups, rewrites, redirects, internationalised routing and the resolution order that decides which handler a request reaches
Products and areas
Covered by Next.js
-
The vercel/next.js repository itself, listed in the program's Tier 1 (High Priority) scope as a source-code asset that is bounty-eligible up to critical severity. Every asset in this program is a GitHub repository, and the per-asset focus list Vercel publishes ranks what they want most rather than fencing off the rest of the framework
Products and areas
Covered by Next.js
-
The vercel/vercel repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. The asset is the repo, and the hosted Vercel platform is a separate program
Products and areas
Covered by Vercel CLI
-
The whole caching stack, covering ISR, the full-route cache, the Data Cache, use cache and the client router cache, along with the keys and revalidation tags each of them derives
Products and areas
Covered by Next.js
-
vercel build and vercel deploy, which read project configuration and run project build scripts from whatever repository the CLI is pointed at
Products and areas
Covered by Vercel CLI
No target matches. Try part of a host name, such as the company name.
Out of scope 15
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.vercel.app
Vercel
-
Build-time tooling such as webpack, babel and terser, which the program places explicitly out of scope
Next.js
-
Cloud-provider and deployment-specific issues, which belong to Vercel's main platform program rather than the open-source one
Next.js
-
Examples, templates and documentation snippets rather than the CLI's own code
Vercel CLI
-
Findings against the Vercel hosted platform, which belong to Vercel's separate main program
Vercel CLI
-
Issues in the development server (next dev) unless you can show a path to production impact
Next.js
-
Issues that require the attacker to already control the machine running the CLI
Vercel CLI
-
Output formatting and other cosmetic issues in the CLI's terminal rendering
Vercel CLI
-
Reports without the mandatory working proof-of-concept artifact, which are not eligible regardless of severity
Vercel CLI
-
Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity
Next.js
-
Scanner output and unverified AI or LLM findings, which the program closes as Not Applicable
Next.js
-
Templates, examples, starter projects and documentation snippets
Next.js
-
Theoretical chains that only work under preconditions no real deployment would meet
Vercel CLI
-
Third-party dependency CVEs without a demonstrated end-to-end chain through Next.js itself
Next.js
-
Vulnerable-dependency reports without a demonstrated exploit chain reaching impact through the CLI
Vercel CLI
Recent changes
Reward and scope changes across every Vercel program, newest first.
-
Paused HackerOne
Paused. Not accepting reports right now.
-
Closed HackerOne
No longer listed as a public program.
Recent CVEs
Published vulnerabilities in Vercel products, from the NVD.
-
CVE-2026-94484 Medium
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content
-
CVE-2026-94485 Medium
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development
-
CVE-2026-94544 Medium
Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a
-
CVE-2026-94543 Medium
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing th
-
CVE-2026-94484 Medium
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content
-
CVE-2026-94486 Low
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development l
-
CVE-2026-94485 Medium
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development
-
CVE-2026-94486 Low
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development l
About this page
This page gathers every public program listed under vercel.com and the companies Vercel owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Vercel.
Something wrong or missing? Report a correction.