# Vercel — $1 million hacker challenge for Vercel Sandbox

- Company: Vercel (vercel.com)
- Announced: 2026-08-18T13:00:00+00:00
- Category: not stated
- Coverage: not counted
- Announcement: no
- Group: routine
- Source: https://vercel.com/blog/one-million-dollar-hacker-challenge-for-vercel-sandbox
- Record: https://forck.live/items/20670-1-million-hacker-challenge-for-vercel-sandbox
- Subject: v0 / AI SDK / AI Gateway
- Pricing: Max per report: $50,000 USD, for a vulnerability that lets a threat actor read or modify another Vercel tenant's data. Total pool : Up to $1,000,000 USD in total payouts.

Vercel launched a two-week public HackerOne bug bounty program offering up to $1,000,000 USD total for vulnerabilities that break Vercel Sandbox isolation, with a maximum of $50,000 per report for critical findings that allow reading or modifying another tenant's data. The program runs from August 18 to September 1, 2026, and covers both compute boundary escapes (Firecracker microVM to host or another tenant) and network boundary defeats (sandbox firewall bypass).

## Evidence

Verbatim from https://vercel.com/blog/one-million-dollar-hacker-challenge-for-vercel-sandbox:

> Starting today , Vercel is running a two-week public HackerOne program focused on Vercel Sandbox isolation.

---

Record: https://forck.live/items/20670-1-million-hacker-challenge-for-vercel-sandbox
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md