Bug bounty program
VE
Vercel
Most upvoted reports16
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Revoked deployment collaborator regains access to private comments after active collaborator interactionAnalysed#3852102 | Input Validation and Logic | 2026-10-29 | $1,026 | 55 |
| Open redirect vuln on login#608031 | Open Redirect | – | – | 45 |
| through %09 Character the attacker is able to steal Github Token [ Account Takeover ]#763058 | Open Redirect | – | – | 44 |
| Gitlab Oauth Misconfiguration Lead To Account Takeover#541701 | No weakness recorded | – | – | 39 |
| Open Redirect on Gitllab Oauth leading to Acount Takeover#677617 | Open Redirect | – | – | 34 |
| CSRF On Connect Account With Github Lead To Account Takeover#542047 | Cross-Site Request Forgery | – | – | 29 |
| Stored XSS on Zeit.co user profile#541737 | Cross-site Scripting | – | – | 21 |
| Stored Cross-site scripting#541710 | Cross-site Scripting | – | – | 13 |
| User personal data disclosure via API#630235 | Information Disclosure | – | – | 12 |
| [Fix Bypass #541631] Open redirect on Signup#541948 | Open Redirect | – | – | 9 |
Subdomains1,259
| Name | Scope | First seen |
|---|---|---|
| dogfood-dev.zeit.shdev | Not in the scope | 2026-11-14 |
| download.zeit.sh | Not in the scope | 2026-11-14 |
| dub.zeit.sh | Not in the scope | 2026-11-14 |
| dyn.zeit.sh | Not in the scope | 2026-11-14 |
| dyndns.zeit.sh | Not in the scope | 2026-11-14 |
| d.d.f.e.zeit.sh | Not in the scope | 2026-11-14 |
| x.d.d.f.e.zeit.sh | Not in the scope | 2026-11-14 |
| edge.zeit.sh | Not in the scope | 2026-11-14 |
| editorconfig.zeit.sh | Not in the scope | 2026-11-14 |
| elastic.zeit.shdata | Not in the scope | 2026-11-14 |
| email.zeit.sh | Not in the scope | 2026-11-14 |
| en.zeit.sh | Not in the scope | 2026-11-14 |
| errors.zeit.sh | Not in the scope | 2026-11-14 |
| exchange.zeit.shmail | Not in the scope | 2026-11-14 |
| file-chmnjcqdqd.zeit.sh | Not in the scope | 2026-11-14 |
| file-dtcacmrwfc.zeit.sh | Not in the scope | 2026-11-14 |
| file-eebzjvlwhz.zeit.sh | Not in the scope | 2026-11-14 |
| file-erpeotnkpw.zeit.sh | Not in the scope | 2026-11-14 |
| file-iqwdixeppp.zeit.sh | Not in the scope | 2026-11-14 |
| file-jiaswoldvl.zeit.sh | Not in the scope | 2026-11-14 |
| file-kxpaitbuhs.zeit.sh | Not in the scope | 2026-11-14 |
| file-oglgyuulln.zeit.sh | Not in the scope | 2026-11-14 |
| file-popogtjubx.zeit.sh | Not in the scope | 2026-11-14 |
| file-rvvylrxvsw.zeit.sh | Not in the scope | 2026-11-14 |
| file-vzbamjcrmu.zeit.sh | Not in the scope | 2026-11-14 |
| file-xfukwiezdk.zeit.sh | Not in the scope | 2026-11-14 |
| file-ysnxjhfnbt.zeit.sh | Not in the scope | 2026-11-14 |
| files-2mu4qbj5d.zeit.shdata | Not in the scope | 2026-11-14 |
| forums.zeit.sh | Not in the scope | 2026-11-14 |
| freddiemac.zeit.sh | Not in the scope | 2026-11-14 |
| front.zeit.sh | Not in the scope | 2026-11-14 |
| front05.zeit.sh | Not in the scope | 2026-11-14 |
| ftp.zeit.shdata | Not in the scope | 2026-11-14 |
| fw.zeit.sh | Not in the scope | 2026-11-14 |
| ga.zeit.sh | Not in the scope | 2026-11-14 |
| gac-rds-external-readonly.zeit.sh | Not in the scope | 2026-11-14 |
| gac-rds-external-readonly-preprod.zeit.shstaging | Not in the scope | 2026-11-14 |
| gcom-product-find-dev.zeit.shdev | Not in the scope | 2026-11-14 |
| gcom-product-find-qa.zeit.shtest | Not in the scope | 2026-11-14 |
| gcp.zeit.sh | Not in the scope | 2026-11-14 |
| git.zeit.shgit | Not in the scope | 2026-11-14 |
| github-repos.zeit.shgit | Not in the scope | 2026-11-14 |
| gitlab.zeit.shgit | Not in the scope | 2026-11-14 |
| go.zeit.sh | Not in the scope | 2026-11-14 |
| goals.zeit.sh | Not in the scope | 2026-11-14 |
| gui.zeit.sh | Not in the scope | 2026-11-14 |
| gw.zeit.sh | Not in the scope | 2026-11-14 |
| gws.zeit.sh | Not in the scope | 2026-11-14 |
| gws-api-sandbox.zeit.shapi, test | Not in the scope | 2026-11-14 |
| gws-dev.zeit.shdev | Not in the scope | 2026-11-14 |
| gws-qa.zeit.shtest | Not in the scope | 2026-11-14 |
| gws-rds-external-readonly-uat.zeit.shtest | Not in the scope | 2026-11-14 |
| gws-uat.zeit.shtest | Not in the scope | 2026-11-14 |
| hackathon-feedback.zeit.sh | Not in the scope | 2026-11-14 |
| hackathon-pre-register.zeit.sh | Not in the scope | 2026-11-14 |
| hackathon-sponsorship.zeit.sh | Not in the scope | 2026-11-14 |
| haulroad.zeit.sh | Not in the scope | 2026-11-14 |
| help.zeit.sh | Not in the scope | 2026-11-14 |
| home.zeit.sh | Not in the scope | 2026-11-14 |
| host.zeit.sh | Not in the scope | 2026-11-14 |
| hostmaster.zeit.sh | Not in the scope | 2026-11-14 |
| httpbin.zeit.sh | Not in the scope | 2026-11-14 |
| hyper-release-metrics.zeit.shmonitoring | Not in the scope | 2026-11-14 |
| hyper-release-metrics-ping.zeit.shmonitoring | Not in the scope | 2026-11-14 |
| hyper-release-metrics-ping-1-1.zeit.shmonitoring | Not in the scope | 2026-11-14 |
| hyper-release-metrics-ping-27.zeit.shmonitoring | Not in the scope | 2026-11-14 |
| hyper-release-metrics-ping-272.zeit.shmonitoring | Not in the scope | 2026-11-14 |
| hyper-release-metrics-ping-3-9.zeit.shmonitoring | Not in the scope | 2026-11-14 |
| iam.zeit.shauth | Not in the scope | 2026-11-14 |
| icn.zeit.sh | Not in the scope | 2026-11-14 |
| images.zeit.sh | Not in the scope | 2026-11-14 |
| imap.zeit.shmail | Not in the scope | 2026-11-14 |
| img.zeit.sh | Not in the scope | 2026-11-14 |
| inbound.zeit.sh | Not in the scope | 2026-11-14 |
| incidents.zeit.sh | Not in the scope | 2026-11-14 |
| info.zeit.sh | Not in the scope | 2026-11-14 |
| integration-controller.zeit.sh | Not in the scope | 2026-11-14 |
| internal.zeit.shinternal | Not in the scope | 2026-11-14 |
| ip.zeit.sh | Not in the scope | 2026-11-14 |
| ipv6.zeit.sh | Not in the scope | 2026-11-14 |
| issues.zeit.sh | Not in the scope | 2026-11-14 |
| job.zeit.sh | Not in the scope | 2026-11-14 |
| jobs.zeit.sh | Not in the scope | 2026-11-14 |
| k8s.zeit.shtools | Not in the scope | 2026-11-14 |
| knowledgemanagement.zeit.sh | Not in the scope | 2026-11-14 |
| ks-inventory-api.zeit.shapi | Not in the scope | 2026-11-14 |
| ks-invoice-api.zeit.shapi | Not in the scope | 2026-11-14 |
| ks-limits-api.zeit.shapi | Not in the scope | 2026-11-14 |
| ks-order-api.zeit.shapi | Not in the scope | 2026-11-14 |
| ks-program-api.zeit.shapi | Not in the scope | 2026-11-14 |
| ks-vendingtransactions-mq1.zeit.sh | Not in the scope | 2026-11-14 |
| ks-vendingtransactions-mq2.zeit.sh | Not in the scope | 2026-11-14 |
| ks-vendingtransactions-mq3.zeit.sh | Not in the scope | 2026-11-14 |
| ks-vendingtransactions-mq4.zeit.sh | Not in the scope | 2026-11-14 |
| kubernetes.zeit.shtools | Not in the scope | 2026-11-14 |
| lists.zeit.sh | Not in the scope | 2026-11-14 |
| liveupdate.zeit.sh | Not in the scope | 2026-11-14 |
| localhost.zeit.shdev | Not in the scope | 2026-11-14 |
| login.zeit.shauth | Not in the scope | 2026-11-14 |
| logs.zeit.shmonitoring | Not in the scope | 2026-11-14 |
378 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.