{"type":"post","id":"the-vercel-bug-bounty-program-is-now-publicly-801278","slug":"the-vercel-bug-bounty-program-is-now-publicly-801278","title":"The Vercel Bug Bounty Program is now publicly available","description":"Vercel is turning its previously private and separate OSS bounty efforts into one public security intake for the entire platform.","retrieval_nugget":"Vercel is turning its previously private and separate OSS bounty efforts into one public security intake for the entire platform.","published_at":"2026-09-24","updated_at":"2026-09-24","record_date":"2026-09-24","date_kind":"published_at","topics":[],"source_urls":["https://vercel.com/blog/the-vercel-bug-bounty-program-is-now-publicly-available"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:the-vercel-bug-bounty-program-is-now-publicly-801278","status":"published","visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:73afbdc97fc2c4df99bc881970176f23623e123fd8b84580f626f9e9268542cb","reviewed_at":"2026-09-24T16:03:14.657Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":2,"related_record_count":0},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Vercel’s unified public bounty program is a bet that security operations can remain open even as AI expands the volume of vulnerability reports.","observed_facts":[{"text":"Vercel says it has combined its private HackerOne program and OSS bounty program into one public Vercel bug bounty program.","source_urls":["https://vercel.com/blog/the-vercel-bug-bounty-program-is-now-publicly-available"]},{"text":"Vercel says all products across its platform and its open-source projects are included in the unified public program.","source_urls":["https://vercel.com/blog/the-vercel-bug-bounty-program-is-now-publicly-available"]},{"text":"Vercel says new open-source findings should be submitted to the main Vercel program.","source_urls":["https://vercel.com/blog/the-vercel-bug-bounty-program-is-now-publicly-available"]}],"mechanism":"A single HackerOne intake consolidates researcher routing while Vercel pairs wider access with tooling and process changes for triage, noise filtering, remediation, and fix verification.","why_now":"Vercel says AI has exponentially increased both valid and invalid reports, but that public reports still produce valuable findings.","implications":["The implication is that public disclosure programs are becoming an operations-scaling problem, not simply a policy choice.","A unified submission path can reduce ambiguity for researchers reporting issues that cross hosted-platform and open-source boundaries."],"evidence_boundary":"These are Vercel’s own claims about program scope, readiness, and process performance; the announcement does not provide report-volume, response-time, payout, or remediation metrics.","watch_conditions":["Whether Vercel publishes evidence that its unified public program maintains fast handling and produces material findings despite higher report volume.","Whether the HackerOne scope and future disclosures show meaningful coverage across the full platform and OSS estate."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied; this begins a distinct record for Vercel’s public-bounty operating model."},"routes":{"html":"https://newruntime.com/posts/the-vercel-bug-bounty-program-is-now-publicly-801278/","markdown":"https://newruntime.com/posts/the-vercel-bug-bounty-program-is-now-publicly-801278.md","json":"https://newruntime.com/posts/the-vercel-bug-bounty-program-is-now-publicly-801278.json"},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"next_reads":[{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}