vulns.co
/
GKData.io MCP

HackerOne · 2 min read

Vercel

Paid Bounty

Open current program Reviewed policy

What this record establishes

Reviewed policy

An individually reviewed public policy is linked to this program page.

Read the reviewed policy profile →

Directory row 5; Active program checkbox checked; Bounties minimum displayed $50. Positive displayed minimum supports paid bounty listing. Policy and live submission availability unverified.

Published asset scope

Snapshot captured 2026-10-03. Scope status: Captured.

In scope · 24 published rows
AssetTypeGroup / eligibility
*.vercel.liveWILDCARDBounty eligible: Yes
*.vercel.comWILDCARDBounty eligible: Yes
vercel.appURLBounty eligible: Yes
vercel.comURLBounty eligible: Yes
v0.devURLBounty eligible: Yes
v0.appURLBounty eligible: Yes
https://github.com/vercelSOURCE_CODEBounty eligible: Yes
https://github.com/nitrojs/nitroSOURCE_CODEBounty eligible: Yes
https://github.com/nuxt/nuxtSOURCE_CODEBounty eligible: Yes
https://github.com/sveltejs/svelteSOURCE_CODEBounty eligible: Yes
https://github.com/vercel-labs/agent-skillsSOURCE_CODEBounty eligible: Yes
https://github.com/vercel-labs/skillsSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/aiSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/async-semaSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/chatSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/flagsSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/next.jsSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/swrSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/turborepoSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/vercelSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/workflowSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/eveSOURCE_CODEBounty eligible: Yes
https://github.com/vercel/msSOURCE_CODEBounty eligible: Yes
Vercel sandboxOTHERBounty eligible: Yes
Out of scope · 1 published rows
AssetTypeGroup / eligibility
*.vercel.appWILDCARDBounty eligible: No

Capture limits

  • Policy displays September 22, 2026; reward page displays September 21, 2026. These are visible update dates, not a complete revision audit.
  • Reviewed pages show dollar signs without an explicit ISO denomination; normalized currency and bounds remain null.
  • Policy-version and reward-version archives, linked attachments, repository-specific policies and authenticated submission flow were not reviewed. The predecessor program URL was not independently verified.
  • Summaries deliberately omit asset inventories and procedural testing instructions. They grant no authorization; full live terms and category-specific exclusions prevail.
  • Published structured-scope rows were captured. Submission eligibility and bounty eligibility differ; program policy text may add restrictions.

Live policy and platform eligibility still require review.

Sources and collection identity

  1. Official program page Primary source · reviewed 2026-10-03
  2. Published scope source Primary source · reviewed 2026-10-03

Appears in Discovery, Bounty, Profile. No identity match is inferred from a shared company name.

GitHub snapshot 2026-10-04

53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software