---
type: "post"
id: "the-vercel-bug-bounty-program-is-now-publicly-801278"
slug: "the-vercel-bug-bounty-program-is-now-publicly-801278"
title: "The Vercel Bug Bounty Program is now publicly available"
description: "Vercel is turning its previously private and separate OSS bounty efforts into one public security intake for the entire platform."
retrieval_nugget: "Vercel is turning its previously private and separate OSS bounty efforts into one public security intake for the entire platform."
published_at: "2026-09-24"
updated_at: "2026-09-24"
record_date: "2026-09-24"
date_kind: "published_at"
topics: []
source_urls: ["https://vercel.com/blog/the-vercel-bug-bounty-program-is-now-publicly-available"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:the-vercel-bug-bounty-program-is-now-publicly-801278"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:73afbdc97fc2c4df99bc881970176f23623e123fd8b84580f626f9e9268542cb","reviewed_at":"2026-09-24T16:03:14.657Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":2,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Vercel’s unified public bounty program is a bet that security operations can remain open even as AI expands the volume of vulnerability reports.","observed_facts":[{"text":"Vercel says it has combined its private HackerOne program and OSS bounty program into one public Vercel bug bounty program.","source_urls":["https://vercel.com/blog/the-vercel-bug-bounty-program-is-now-publicly-available"]},{"text":"Vercel says all products across its platform and its open-source projects are included in the unified public program.","source_urls":["https://vercel.com/blog/the-vercel-bug-bounty-program-is-now-publicly-available"]},{"text":"Vercel says new open-source findings should be submitted to the main Vercel program.","source_urls":["https://vercel.com/blog/the-vercel-bug-bounty-program-is-now-publicly-available"]}],"mechanism":"A single HackerOne intake consolidates researcher routing while Vercel pairs wider access with tooling and process changes for triage, noise filtering, remediation, and fix verification.","why_now":"Vercel says AI has exponentially increased both valid and invalid reports, but that public reports still produce valuable findings.","implications":["The implication is that public disclosure programs are becoming an operations-scaling problem, not simply a policy choice.","A unified submission path can reduce ambiguity for researchers reporting issues that cross hosted-platform and open-source boundaries."],"evidence_boundary":"These are Vercel’s own claims about program scope, readiness, and process performance; the announcement does not provide report-volume, response-time, payout, or remediation metrics.","watch_conditions":["Whether Vercel publishes evidence that its unified public program maintains fast handling and produces material findings despite higher report volume.","Whether the HackerOne scope and future disclosures show meaningful coverage across the full platform and OSS estate."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied; this begins a distinct record for Vercel’s public-bounty operating model."}
routes: {"html":"https://newruntime.com/posts/the-vercel-bug-bounty-program-is-now-publicly-801278/","markdown":"https://newruntime.com/posts/the-vercel-bug-bounty-program-is-now-publicly-801278.md","json":"https://newruntime.com/posts/the-vercel-bug-bounty-program-is-now-publicly-801278.json"}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
---

# The Vercel Bug Bounty Program is now publicly available

## Retrieval answer

Vercel is turning its previously private and separate OSS bounty efforts into one public security intake for the entire platform.

Vercel is turning its previously private and separate OSS bounty efforts into one public security intake for the entire platform. The event is operationally meaningful because it changes both the research surface available to outsiders and the company’s stated capacity to process the resulting report volume.

Thesis: Vercel’s unified public bounty program is a bet that security operations can remain open even as AI expands the volume of vulnerability reports. The company says it combined its private HackerOne program and its OSS bounty program into a single public program. It also says that all Vercel platform products and open-source projects are in scope, while new OSS findings should go through the main Vercel program.

Mechanism: A single HackerOne intake consolidates researcher routing while Vercel pairs wider access with tooling and process changes for triage, noise filtering, remediation, and fix verification. Why now: Vercel says AI has exponentially increased both valid and invalid reports, but that public reports still produce valuable findings. The implication is that public disclosure programs are becoming an operations-scaling problem, not simply a policy choice. Evidence boundary: These are Vercel’s own claims about program scope, readiness, and process performance; the announcement does not provide report-volume, response-time, payout, or remediation metrics. Watch condition: Whether Vercel publishes evidence that its unified public program maintains fast handling and produces material findings despite higher report volume.

Source: https://vercel.com/blog/the-vercel-bug-bounty-program-is-now-publicly-available

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)