Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Vercel Open Source

By Vercel Bug bounty on HackerOne vercel.com

Paused
Go to program Website
Top reward
$10,000
Top severity paid
Critical
Assets in scope
19
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $10,000
for critical bugs.
Report on HackerOne
Submit through the program page.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $10,000 from $2,750
High $5,000 from $750
Medium $1,000 from $250
Low $500 from $50
Earlier reward tables (1)
  • 12 Nov 2026 to 12 Nov 2026: Critical up to $10,000

Scope

19 assets you may test.

Source code 16

  • https://github.com/nitrojs/nitro No bounty
  • https://github.com/nuxt/nuxt No bounty
  • https://github.com/sveltejs/svelte No bounty
  • https://github.com/vercel/ai No bounty
  • https://github.com/vercel/async-sema No bounty
  • https://github.com/vercel/chat No bounty
  • https://github.com/vercel/eve No bounty
  • https://github.com/vercel/flags No bounty
  • https://github.com/vercel-labs/agent-skills No bounty
  • https://github.com/vercel-labs/skills No bounty
  • https://github.com/vercel/ms No bounty
  • https://github.com/vercel/next.js No bounty
  • https://github.com/vercel/swr No bounty
  • https://github.com/vercel/turborepo No bounty
  • https://github.com/vercel/vercel No bounty
  • https://github.com/vercel/workflow No bounty

Products and areas 3

  • Tier 1 OSS No bounty
  • Tier 2 OSS No bounty
  • Tier 3 OSS No bounty

Changes

Tracked since 12 Nov 2026. Last checked 43 minutes ago.

  1. Paused

    Paused. Not accepting reports right now.

  2. Closed

    No longer listed as a public program.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Status

    Program status changed

  2. Rules updated

    Removed: “<details>”

  3. Rules updated

    Added: “<details>”

  4. Rules updated

    Removed: “Token exfiltration via repo-controlled configuration: the ability to point the remote cache at an attacker-controlled origin and receive the user's auth token....”

  5. Status

    Program status changed

  6. Rules updated

    Added: “⚠️ **Not accepting new submissions.** Moving forward, please report Vercel open source findings at https://hackerone.com/vercel. In-progress reports will remain...”

  7. Rules updated

    Added: “Svelte (Tier 1)”

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.