In 2022, we launched a private bug bounty program through HackerOne. Over the last several years, we've worked with HackerOne's VIP program to refine our process, targets, and scope, onboarding thousands of their best researchers and hardening security across our platform.

We've translated those learnings into several public bounty programs:

Today, we are combining our private and OSS bounty programs into a single, public Vercel bug bounty program .

Copy link to heading Why now

AI has fundamentally changed the nature of bug bounty programs, exponentially increasing the number of reports, both valid and invalid. Some companies are responding by moving to private programs.

At Vercel, we’ve found that public reports are still surfacing real, valuable findings.…