Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Vite bug bounty programs

vite.dev Updated

Vite runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
11
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Vite runs.

  • Vite

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 5 excluded.

  • https://vite.dev

    Web

  • Configuration loading, environment variable handling and the import.meta.env inlining that decides which values reach the client bundle

    Products and areas

  • Origin and host validation on the dev server, covering CORS, the HMR WebSocket endpoint and the checks meant to stop a page in the browser talking to a local dev server

    Products and areas

  • SSR support and the middleware mode Vite exposes to the frameworks that embed it

    Products and areas

  • The build pipeline: plugin execution, asset handling and anything that puts content into an output bundle

    Products and areas

  • The dev server in full: request routing, static file serving, the server.fs allow and deny handling, and every path that maps a URL onto a file on disk

    Products and areas

  • The HMR channel end to end, including what a connected client is able to ask the server to do

    Products and areas

  • The module transform and import-analysis pipeline, including how a request path resolves to a module and what ends up inlined into the response

    Products and areas

  • The plugin API and the official plugins published from the Vite repository

    Products and areas

  • The policy is a single line: open a private vulnerability report on the repository's security tab. It names no exclusions and draws no boundary narrower than Vite itself, so the whole tool is in scope

    Products and areas

  • The preview server, which serves a production build and is exposed on a network far more deliberately than vite dev ever is

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • An operator deliberately binding the dev server to a public interface and calling that the bug. A traversal past server.fs.deny is a Vite defect; publishing the dev server is a configuration decision

  • Bugs in a framework built on Vite rather than in Vite. Nuxt, SvelteKit and Astro run their own security processes

  • Findings that require a malicious project's own source or configuration, since running an untrusted repository's build is already code execution by design

  • Rollup and esbuild defects that Vite only inherits, unless Vite's own use of them is what makes the issue reachable

  • Third-party plugins not published from the Vite repository

Recent changes

Reward and scope changes across every Vite program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under vite.dev: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.