# Vercel: bug bounty program on HackerOne

> Vercel is a bug bounty program on HackerOne. Its critical reports have paid an average of $4,900 across 22 reports (HackerOne figures, November 7, 2026). It received 4,165 reports in the 90 days to November 7, 2026, about 154 per in-scope asset.

- **Company:** Vercel
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/vercel
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** September 21, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/vercel

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $4,900 | 22 |
| High | $2,244 | 95 |
| Medium | $1,107 | 159 |
| Low | $293 | 74 |

- Reports received in the last 90 days: 4,165 (about 154 per in-scope asset)
- Bounties paid in the last 90 days: $69,981
- Bounties paid in total: $688,015
- Researchers participating: 312
- Response efficiency: 95%
- First-response target: 1 day
- Triage target: 7 days
- Bounty target: 10 days

## Scope

As imported from HackerOne on November 6, 2026: 27 assets in scope (27 bounty-eligible), 2 out of scope. The policy page is the authority.

- `*.vercel.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.vercel.live` (WILDCARD): in scope, bounty-eligible, max severity critical
- `https://github.com/better-auth/better-auth` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/nitrojs/nitro` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/nuxt/nuxt` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/sveltejs/kit` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/sveltejs/svelte` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel-labs/agent-skills` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel-labs/skills` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/ai` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/async-sema` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/chat` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/eve` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/flags` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/ms` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/next.js` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/swr` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/turborepo` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/vercel` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://github.com/vercel/workflow` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `v0.app` (URL): in scope, bounty-eligible, max severity critical
- `v0.dev` (URL): in scope, bounty-eligible, max severity critical
- `Vercel sandbox` (OTHER): in scope, bounty-eligible, max severity critical
- `vercel.app` (URL): in scope, bounty-eligible, max severity critical
- `vercel.com` (URL): in scope, bounty-eligible, max severity critical
- `vercel.sh` (URL): in scope, bounty-eligible, max severity critical
- `*.vercel.app` (WILDCARD): out of scope, max severity none
- `Source Code Repository` (OTHER): out of scope, max severity none

## Recent public accepted findings

- October 29, 2026: medium severity, awarded $1,026

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.