Vercel opened a public HackerOne programme on 18 August offering up to $1,000,000 to researchers who can escape a Vercel Sandbox. The post went out at 13:00 UTC.
The terms
The window runs Tuesday 18 August to Tuesday 1 September 2026, "or earlier if the reward pool is exhausted." The maximum single payout is $50,000, for a vulnerability letting a threat actor read or modify another Vercel tenant's data. Two boundaries are in scope: the compute boundary — escaping the Firecracker microVM to reach the EC2 host or another tenant's sandbox — and the network boundary, defeating the sandbox firewall to reach unauthorised destinations or exfiltrate data.
What the common telling gets wrong
"Vercel offers $1m bug bounty" misses both limits. This is a pooled, time-boxed budget, not a standing bounty: it can end in fourteen days, or sooner if researchers claim the pool. And the $1m is not a per-finding prize — the ceiling on any single report is one-twentieth of the headline figure.
The scope exclusion is the sharper detail. "Container namespace escapes that only reach the Firecracker guest OS are not in scope." Breaking out of a container into the guest operating system — the class of finding that would be the whole result in most container-based sandboxes — earns nothing here, because Vercel's security claim is that the microVM boundary holds even when the layer above it does not. The programme is engineered to test exactly one proposition.
Why a sandbox is worth $1m of attention now
Vercel Sandbox exists to run untrusted code — increasingly, code written by AI agents on behalf of users. That makes the microVM boundary the thing standing between one customer's agent and another customer's data, and a strong isolation claim is now a product feature that has to be defensible rather than asserted. Publishing a scope that excludes the easier finding is a way of saying which boundary the company is actually willing to bet on.