Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Vercel Bug Bounty Program is now public on HackerOne
- Security
- Course
Instructor-curated digest, not original reporting. Each post paraphrases a public article and links to the original source.
On September 24, 2026, Caleb An and Talha Tariq announced that Vercel is combining its private and open-source bounty programs into a single public Vercel bug bounty program on HackerOne. Earlier public efforts named in the post include the $1 million React2Shell hacker challenge, the $1 million Vercel Sandbox hacker challenge, and the OSS bug bounty program.
All products across the Vercel platform and open-source projects are in scope. New OSS findings go to the main program; existing OSS submissions do not need to be copied over. The post says AI has increased both valid and invalid reports, and that Vercel streamlined triage tooling rather than closing the program. Researchers submit through HackerOne with clear reproduction steps.
That disclosure path is the same platform security hygiene as Chapter 1 and the Node dependency work in Chapter 5.
Read original: The Vercel Bug Bounty Program is now publicly available — Vercel