In brief. Vercel Open Source is a bug bounty program on HackerOne. Its critical reports have paid an average of $6,978 across 13 reports (HackerOne figures, November 7, 2026). It received 2,885 reports in the 90 days to November 7, 2026, about 144 per in-scope asset. As of Nov 7, 2026. Markdown for agents

NR Unrated

Vercel Open Source

Vercel Open Source HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at Vercel Open Source? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 7 Nov 2026.

What it pays, by severity

Critical $6,978 avg 13 reports indicative

High $3,401 avg 26 reports firm

Medium $534 avg 64 reports firm

Low $293 avg 31 reports firm

$334,534 paid to researchers in total, $92,851 of it in the last 90 days. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received

2,885

in 90 days

Resolved

136

all time, last one 3 days ago

Participants

935

hunters engaged

Response efficiency

89%

meeting its targets, HackerOne’s figure

SLA misses

targets missed

Reports received, day by day, last 29 days 2,885–4,620

9 Oct 2,885 reports 7 Nov

Response targets it sets itself

First response

1 day

Triage

7 days

Bounty

10 days

Resolution

30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

submissions paused

Over 77 days (53 snapshots): intake down 1,495 reports; response efficiency down 1 points; 90-day payout down $8,294.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

933 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	andrewmohawk	213	7 / 38 18%
2	aphantom	189	6 / 12 50%
3	adnanthekhan	175	4 / 5 80%
4	sndd	148	7 / 22 32%
5	jviide	142	6 / 9 67%
6	mxnd	139	4 / 22 18%
7	aviv_keller	116	3 / 4 75%
8	hellnia	114	2 / 4 50%
9	anakin77	111	2 / 8 25%
10	rafabd1	107	8 / 35 23%
11	cswiers	88	4 / 12 33%
11	bjorm	79	3 / 6 50%
12	ragrocks	86	3 / 7 43%
13	maru1001	79	2 / 12 17%
14	kq5y	78	3 / 17 18%
15	cyberjoker	76	3 / 11 27%
16	geeknik	70	4 / 16 25%
17	a77w3	69	3 / 31 10%
18	mister_mime	66	1 / 7 14%
19	artahir	63	2 / 45 4%
20	ruthubetsiz	61	2 / 6 33%
20	maru_1009	57	1 / 4 25%
21	altair00	59	2 / 2 100%
21	b0r1	59	2 / 3 67%
21	randomguy6407	59	2 / 6 33%

Showing the top 25 of 933 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 5 Nov 2026.

Responsiveness

89% HackerOne’s figure

Swag

Currency

USD

Submissions

Paused

Launched

Feb 2026

Scope entries

20 HackerOne’s count

Scope

20 assets

Asset	Type	Eligibility	Max severity
*.now.sh	WILDCARD	✓ bounty	Critical
https://github.com/nitrojs/nitro	SOURCE CODE	✓ bounty	Critical
https://github.com/nuxt/nuxt	SOURCE CODE	✓ bounty	Critical
https://github.com/sveltejs/svelte	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel-labs/agent-skills	SOURCE CODE	✓ bounty	Critical

Show all 20 assets

Asset	Type	Eligibility	Max severity
https://github.com/vercel-labs/skills	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/ai	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/async-sema	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/chat	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/eve	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/flags	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/ms	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/next.js	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/swr	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/turborepo	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/vercel	SOURCE CODE	✓ bounty	Critical
https://github.com/vercel/workflow	SOURCE CODE	✓ bounty	Critical
Tier 1 OSS	OTHER	✓ bounty	Critical
Tier 2 OSS	OTHER	✓ bounty	Critical
Tier 3 OSS	OTHER	✓ bounty	Critical

Known vulnerabilities in in-scope packages

128 from OSV.dev

Published vulnerabilities in the packages and repositories this program lists in scope, from the open OSV.dev database. They are already public, so they are context for where the code has broken before, not findings to report.

Advisory	Package	Severity	Published
CVE-2026-120309 Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam	github.com/nuxt/nuxt	CVSS	2 Nov 2026
CVE-2026-119201 Nuxt dev server exposes generated appSecret through Vite file serving	github.com/nuxt/nuxt	CVSS	29 Oct 2026
CVE-2026-119200 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes	github.com/nuxt/nuxt	CVSS	29 Oct 2026
CVE-2026-119199 Nuxt dev server exposes private runtime config through the Nitro dev bundle	github.com/nuxt/nuxt	CVSS	29 Oct 2026
CVE-2026-119198 Nuxt dev server arbitrary file read through client error reports	github.com/nuxt/nuxt	CVSS	29 Oct 2026

Showing the newest 5 of 128.