Vercel· 18 Aug$1 million hacker challenge for Vercel Sandbox
Vercel offers up to $1M for sandbox escape findings
Vercel launched a two-week public HackerOne bug bounty program offering up to $1,000,000 USD total for vulnerabilities that break Vercel Sandbox isolation, with a maximum of $50,000 per report for critical findings that allow reading or modifying another tenant's data.
The program runs from August 18 to September 1, 2026, and covers both compute boundary escapes (Firecracker microVM to host or another tenant) and network boundary defeats (sandbox firewall bypass).
