Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
26 in-scope
*.vercel.comscope· critical*.vercel.livescope· criticalv0.app· criticalv0.dev· criticalvercel.app· criticalvercel.com· criticalgithub.com/sveltejs/kit· criticalgithub.com/better-auth/better-auth· criticalgithub.com/nitrojs/nitro· criticalgithub.com/nuxt/nuxt· criticalgithub.com/sveltejs/svelte· criticalgithub.com/vercel· criticalgithub.com/vercel-labs/agent-skills· criticalgithub.com/vercel-labs/skills· criticalgithub.com/vercel/ai· criticalgithub.com/vercel/async-sema· criticalgithub.com/vercel/chat· criticalgithub.com/vercel/eve· criticalgithub.com/vercel/flags· criticalgithub.com/vercel/ms· criticalgithub.com/vercel/next.js· criticalgithub.com/vercel/swr· criticalgithub.com/vercel/turborepo· criticalgithub.com/vercel/vercel· criticalgithub.com/vercel/workflow· criticalVercel sandbox· critical*.vercel.appwildcard+ added 1 scope · https://github.com/better-auth/better-auth
6d ago
+ added 1 scope · https://github.com/sveltejs/kit
16d ago
first indexed
36d ago · 24 in-scope assets
No reports yet. Be the first to share your triage timing for Vercel.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/vercel",
"name": "Vercel",
"handle": "vercel",
"targets": {
"in_scope": [
{
"asset_type": "WILDCARD",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "*.vercel.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "WILDCARD",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.vercel.live",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Vercel Sandbox lets customers run programs in an isolated environment, take disk snapshots, limit egress network connections, and perform credential brokering at the networking level.\n\nThe Firecracker microVM is the isolation boundary; escaping the container into the guest OS alone does not qualify. In-scope findings include escapes to the underlying host, cross-tenant access on another customer's sandbox, Sandbox firewall bypasses, Vercel-side exposure of brokered credentials, and Sandbox control-plane authentication or authorization flaws.\n\nSee Sandbox-specific architecture, examples, known findings, testing instructions and out of scope exclusions in the attached document. ",
"max_severity": "critical",
"asset_identifier": "Vercel sandbox",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "medium",
"confidentiality_requirement": "high"
},
{
"asset_type": "SOURCE_CODE",
"instruction": "In scope for core library issues, out of scope for example code / reference code or documentation unless documentation is severely putting users in harm way",
"max_severity": "critical",
"asset_identifier": "https://github.com/better-auth/better-auth",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/nitrojs/nitro",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/nuxt/nuxt",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/sveltejs/kit",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/sveltejs/svelte",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": "If you have found a repository configuration issue (e.g. vulnerable GitHub Action), please report this here.\n\nOut of scope:\n- Vulnerable/outdated dependencies\n- Best practices\n- Bugs in the code itself: please report this to our responsible disclosure program instead.",
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel-labs/agent-skills",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel-labs/skills",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/ai",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/async-sema",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/chat",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/eve",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/flags",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/ms",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/next.js",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/swr",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/turborepo",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/vercel",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "SOURCE_CODE",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "https://github.com/vercel/workflow",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "v0.app",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "v0.dev",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "vercel.app",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "vercel.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "WILDCARD",
"instruction": "*.vercel.app hosts applications belonging to our customers. If you believe you have found a vulnerability on a *.vercel.app website, please contact the customer directly",
"max_severity": "none",
"asset_identifier": "*.vercel.app",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "https://vercel.com/",
"offers_swag": false,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 579,
"response_efficiency_percentage": 95,
"average_time_to_report_resolved": 989,
"average_time_to_first_program_response": 1
}