Skip to content
Connect AISign inSign up free

Bug bounty program

VE

Vercel

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
26
Disclosed reports
16
Subdomains
1,259
Vendor on CyberSIXT
Vercel (80 CVEs, 0 exploited)

Most upvoted reports16

All reports
Most upvoted reports of Vercel
ReportWeaknessDisclosedBountyVotes
Revoked deployment collaborator regains access to private comments after active collaborator interactionAnalysed#3852102Input Validation and Logic2026-10-29$1,02655
Open redirect vuln on login#608031Open Redirect––45
through %09 Character the attacker is able to steal Github Token [ Account Takeover ]#763058Open Redirect––44
Gitlab Oauth Misconfiguration Lead To Account Takeover#541701No weakness recorded––39
Open Redirect on Gitllab Oauth leading to Acount Takeover#677617Open Redirect––34
CSRF On Connect Account With Github Lead To Account Takeover#542047Cross-Site Request Forgery––29
Stored XSS on Zeit.co user profile#541737Cross-site Scripting––21
Stored Cross-site scripting#541710Cross-site Scripting––13
User personal data disclosure via API#630235Information Disclosure––12
[Fix Bypass #541631] Open redirect on Signup#541948Open Redirect––9

Subdomains1,259

Root
Scope
Name suggests
First seen
Text file1,259 names
Subdomains of Vercel
NameScopeFirst seen
m.zeit.shNot in the scope2026-11-14
mail.zeit.shmailNot in the scope2026-11-14
mail1.zeit.shmailNot in the scope2026-11-14
mail2.zeit.shmailNot in the scope2026-11-14
mailserver.zeit.shNot in the scope2026-11-14
mdm.zeit.shNot in the scope2026-11-14
mdx-example.zeit.shNot in the scope2026-11-14
media.zeit.shNot in the scope2026-11-14
merchandising-preview.zeit.shstagingNot in the scope2026-11-14
mersvirus.zeit.shNot in the scope2026-11-14
metrics.zeit.shmonitoringNot in the scope2026-11-14
metrics-handler.zeit.shmonitoringNot in the scope2026-11-14
metrics-handler-10.zeit.shmonitoringNot in the scope2026-11-14
metrics-handler-108.zeit.shmonitoringNot in the scope2026-11-14
metrics-handler-403.zeit.shmonitoringNot in the scope2026-11-14
metrics-handler-41-2.zeit.shmonitoringNot in the scope2026-11-14
metrics-handler5-2.zeit.shmonitoringNot in the scope2026-11-14
metrics-handler6-97.zeit.shmonitoringNot in the scope2026-11-14
arn1.metrics.zeit.shmonitoringNot in the scope2026-11-14
bom1.metrics.zeit.shmonitoringNot in the scope2026-11-14
bru1.metrics.zeit.shmonitoringNot in the scope2026-11-14
cdg1.metrics.zeit.shmonitoringNot in the scope2026-11-14
chs1.metrics.zeit.shmonitoringNot in the scope2026-11-14
cle1.metrics.zeit.shmonitoringNot in the scope2026-11-14
dub1.metrics.zeit.shmonitoringNot in the scope2026-11-14
gru1.metrics.zeit.shmonitoringNot in the scope2026-11-14
hel1.metrics.zeit.shmonitoringNot in the scope2026-11-14
hkg1.metrics.zeit.shmonitoringNot in the scope2026-11-14
hnd1.metrics.zeit.shmonitoringNot in the scope2026-11-14
iad1.metrics.zeit.shmonitoringNot in the scope2026-11-14
icn1.metrics.zeit.shmonitoringNot in the scope2026-11-14
lax1.metrics.zeit.shmonitoringNot in the scope2026-11-14
lhr1.metrics.zeit.shmonitoringNot in the scope2026-11-14
oma1.metrics.zeit.shmonitoringNot in the scope2026-11-14
pdx1.metrics.zeit.shmonitoringNot in the scope2026-11-14
sfo1-sidecar.metrics.zeit.shmonitoringNot in the scope2026-11-14
sfo1-sidecar-0.metrics.zeit.shmonitoringNot in the scope2026-11-14
sfo1-sidecar-1.metrics.zeit.shmonitoringNot in the scope2026-11-14
sfo1-store.metrics.zeit.shmonitoringNot in the scope2026-11-14
sin1.metrics.zeit.shmonitoringNot in the scope2026-11-14
syd1.metrics.zeit.shmonitoringNot in the scope2026-11-14
tpe1.metrics.zeit.shmonitoringNot in the scope2026-11-14
yul1.metrics.zeit.shmonitoringNot in the scope2026-11-14
zrh1.metrics.zeit.shmonitoringNot in the scope2026-11-14
metrodetmetrics-handler.zeit.shNot in the scope2026-11-14
ml.zeit.shNot in the scope2026-11-14
mobile.zeit.shNot in the scope2026-11-14
mobile-rest.zeit.shNot in the scope2026-11-14
mongo.zeit.shdataNot in the scope2026-11-14
mongodb.zeit.shdataNot in the scope2026-11-14
api.accounts.moonwalkooks.zeit.shapiNot in the scope2026-11-14
mssql.zeit.shNot in the scope2026-11-14
mta-sts.zeit.shNot in the scope2026-11-14
mx.zeit.shmailNot in the scope2026-11-14
mx01.zeit.shNot in the scope2026-11-14
mx1.zeit.shNot in the scope2026-11-14
mx2.zeit.shNot in the scope2026-11-14
mycoviruses.zeit.shNot in the scope2026-11-14
mysql.zeit.shdataNot in the scope2026-11-14
new.zeit.shNot in the scope2026-11-14
news.zeit.shNot in the scope2026-11-14
nextjs-static-example.zeit.shNot in the scope2026-11-14
nginx.zeit.shNot in the scope2026-11-14
nginx-newest.zeit.shNot in the scope2026-11-14
nginx-newest1.zeit.shNot in the scope2026-11-14
nkzawa.zeit.shNot in the scope2026-11-14
wildcard.nkzawa.zeit.shNot in the scope2026-11-14
no-cdn.zeit.shNot in the scope2026-11-14
wildcard.no-cdn.zeit.shNot in the scope2026-11-14
nocdn.zeit.shNot in the scope2026-11-14
wildcard.nocdn.zeit.shNot in the scope2026-11-14
nodejs.zeit.shNot in the scope2026-11-14
nodejs-binaries.zeit.shNot in the scope2026-11-14
nodejs-dev.zeit.shdevNot in the scope2026-11-14
non-prod.zeit.shNot in the scope2026-11-14
now-build-env-starter-dynamic-rismihvmtj.zeit.shciNot in the scope2026-11-14
now-cli-latest.zeit.shNot in the scope2026-11-14
now-cli-latest-6-7.zeit.shNot in the scope2026-11-14
now-cli-release-metrics.zeit.shmonitoringNot in the scope2026-11-14
now-cli-release-metrics-ping.zeit.shmonitoringNot in the scope2026-11-14
now-cli-release-metrics-ping-0-14.zeit.shmonitoringNot in the scope2026-11-14
now-cli-release-metrics-ping-079.zeit.shmonitoringNot in the scope2026-11-14
now-cli-release-metrics-ping-1-1-4.zeit.shmonitoringNot in the scope2026-11-14
now-cli-release-metrics-ping-7-0.zeit.shmonitoringNot in the scope2026-11-14
now-cli-release-metrics-ping-7-6-1.zeit.shmonitoringNot in the scope2026-11-14
now-cli-release-metrics-ping3-3-3.zeit.shmonitoringNot in the scope2026-11-14
now-cli-release-metrics-ping34-9.zeit.shmonitoringNot in the scope2026-11-14
now-cli-releases.zeit.shNot in the scope2026-11-14
now-desktop-release-metrics.zeit.shmonitoringNot in the scope2026-11-14
now-desktop-release-metrics-ping.zeit.shmonitoringNot in the scope2026-11-14
now-desktop-release-metrics-ping-43.zeit.shmonitoringNot in the scope2026-11-14
now-desktop-release-metrics-ping24.zeit.shmonitoringNot in the scope2026-11-14
now-desktop-release-metrics-ping5-7.zeit.shmonitoringNot in the scope2026-11-14
now-desktop-releases.zeit.shNot in the scope2026-11-14
now-desktop-releases-canary.zeit.shstagingNot in the scope2026-11-14
now-example-files.zeit.shdataNot in the scope2026-11-14
now-examples-3ok9tvp04.zeit.shNot in the scope2026-11-14
now-examples-4g862co7w.zeit.shNot in the scope2026-11-14
now-examples-6pn2lr1ir.zeit.shNot in the scope2026-11-14
now-examples-7voymifaz.zeit.shNot in the scope2026-11-14

378 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated