Vercel Offers Up to $1 Million in Bug Bounties for Researchers Who Can Break Its Sandbox Security
Summary
Vercel is putting up to $1,000,000 on the line in a two-week public bug bounty challenge, daring security researchers to escape its Firecracker microVM-powered sandbox infrastructure, with individual payouts reaching $50,000 per confirmed exploit running August 18 to September 1, 2026.
Key Points
- Vercel launches a two-week public bug bounty challenge on HackerOne, offering up to $1,000,000 USD in total payouts to security researchers who can escape a Vercel Sandbox, running from August 18 to September 1, 2026.
- Vercel Sandbox runs on bare-metal EC2 hosts using Firecracker microVMs with dedicated guest kernels, and researchers are challenged to break either the compute boundary by escaping the microVM or reaching another tenant, or the network boundary by bypassing the sandbox firewall.
- Individual bounties range from $1,000 to $50,000 per report depending on severity, live proof-of-concept exploits are required for payout, and all confirmed techniques will be permanently integrated into Vercel Sandbox security after the program closes.