Bug bounty program
VE
Vercel
Most upvoted reports16
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Revoked deployment collaborator regains access to private comments after active collaborator interactionAnalysed#3852102 | Input Validation and Logic | 2026-10-29 | $1,026 | 55 |
| Open redirect vuln on login#608031 | Open Redirect | – | – | 45 |
| through %09 Character the attacker is able to steal Github Token [ Account Takeover ]#763058 | Open Redirect | – | – | 44 |
| Gitlab Oauth Misconfiguration Lead To Account Takeover#541701 | No weakness recorded | – | – | 39 |
| Open Redirect on Gitllab Oauth leading to Acount Takeover#677617 | Open Redirect | – | – | 34 |
| CSRF On Connect Account With Github Lead To Account Takeover#542047 | Cross-Site Request Forgery | – | – | 29 |
| Stored XSS on Zeit.co user profile#541737 | Cross-site Scripting | – | – | 21 |
| Stored Cross-site scripting#541710 | Cross-site Scripting | – | – | 13 |
| User personal data disclosure via API#630235 | Information Disclosure | – | – | 12 |
| [Fix Bypass #541631] Open redirect on Signup#541948 | Open Redirect | – | – | 9 |
Subdomains1,259
| Name | Scope | First seen |
|---|---|---|
| now-examples-7xu2100yl.zeit.sh | Not in the scope | 2026-11-14 |
| now-examples-9zv8bcocf.zeit.sh | Not in the scope | 2026-11-14 |
| now-examples-api.zeit.shapi | Not in the scope | 2026-11-14 |
| now-examples-babjlep7s.zeit.sh | Not in the scope | 2026-11-14 |
| now-examples-crsku8zyd.zeit.sh | Not in the scope | 2026-11-14 |
| now-examples-d8gbron9h.zeit.sh | Not in the scope | 2026-11-14 |
| now-examples-dge5dpeg6.zeit.sh | Not in the scope | 2026-11-14 |
| now-examples-dhev9x619.zeit.sh | Not in the scope | 2026-11-14 |
| now-examples-git-add-metalsmith-example.zeit.shgit | Not in the scope | 2026-11-14 |
| now-examples-git-add-package-lockjson.zeit.shgit | Not in the scope | 2026-11-14 |
| now-examples-git-fix-hugo-toml-syntax.zeit.shgit | Not in the scope | 2026-11-14 |
| now-examples-git-master.zeit.shgit | Not in the scope | 2026-11-14 |
| now-examples-git-sarup-fix-jekyll-example.zeit.shgit | Not in the scope | 2026-11-14 |
| now-examples-git-update-gitignore.zeit.shgit | Not in the scope | 2026-11-14 |
| now-examples-j447nc3bq.zeit.sh | Not in the scope | 2026-11-14 |
| now-examples-jdapua2dm.zeit.sh | Not in the scope | 2026-11-14 |
| now-examples-rnwbzp2r8.zeit.sh | Not in the scope | 2026-11-14 |
| ns.zeit.sh | Not in the scope | 2026-11-14 |
| ns1.zeit.sh | Not in the scope | 2026-11-14 |
| ns2.zeit.sh | Not in the scope | 2026-11-14 |
| ns3.zeit.sh | Not in the scope | 2026-11-14 |
| ns4.zeit.sh | Not in the scope | 2026-11-14 |
| nsolid.zeit.sh | Not in the scope | 2026-11-14 |
| nsolid-pdx1.zeit.sh | Not in the scope | 2026-11-14 |
| office.zeit.sh | Not in the scope | 2026-11-14 |
| office-warming-api.zeit.shapi | Not in the scope | 2026-11-14 |
| office-warming-api3.zeit.shapi | Not in the scope | 2026-11-14 |
| office-warming-api32.zeit.shapi | Not in the scope | 2026-11-14 |
| okta.zeit.shauth | Not in the scope | 2026-11-14 |
| old.zeit.shlegacy | Not in the scope | 2026-11-14 |
| orders.zeit.sh | Not in the scope | 2026-11-14 |
| outlook.zeit.sh | Not in the scope | 2026-11-14 |
| owa.zeit.shmail | Not in the scope | 2026-11-14 |
| phantomized.zeit.sh | Not in the scope | 2026-11-14 |
| phantomized0-7.zeit.sh | Not in the scope | 2026-11-14 |
| phantomized4-2.zeit.sh | Not in the scope | 2026-11-14 |
| phantomized8.zeit.sh | Not in the scope | 2026-11-14 |
| phantomized8-6.zeit.sh | Not in the scope | 2026-11-14 |
| phantomized9-2.zeit.sh | Not in the scope | 2026-11-14 |
| pingdom-tests.zeit.shtest | Not in the scope | 2026-11-14 |
| wildcard.pingdom-tests.zeit.shtest | Not in the scope | 2026-11-14 |
| pop.zeit.sh | Not in the scope | 2026-11-14 |
| pop3.zeit.shmail | Not in the scope | 2026-11-14 |
| postmaster.zeit.sh | Not in the scope | 2026-11-14 |
| pre.zeit.sh | Not in the scope | 2026-11-14 |
| pre-prod.zeit.sh | Not in the scope | 2026-11-14 |
| preview.zeit.shstaging | Not in the scope | 2026-11-14 |
| proxy.zeit.sh | Not in the scope | 2026-11-14 |
| prs.zeit.sh | Not in the scope | 2026-11-14 |
| prs-81.zeit.sh | Not in the scope | 2026-11-14 |
| publishing-catalog.zeit.sh | Not in the scope | 2026-11-14 |
| publishing-preview.zeit.shstaging | Not in the scope | 2026-11-14 |
| real-no-cdn.zeit.sh | Not in the scope | 2026-11-14 |
| wildcard.real-no-cdn.zeit.sh | Not in the scope | 2026-11-14 |
| api-v20.staging.duflapi.com.ream.zeit.shapi, staging | Not in the scope | 2026-11-14 |
| redirect-to-zeit-co-domains.zeit.sh | Not in the scope | 2026-11-14 |
| redirects.zeit.sh | Not in the scope | 2026-11-14 |
| redirectsoftwareforupdatrect-to-zeit-co-domains.zeit.sh | Not in the scope | 2026-11-14 |
| release-auth.zeit.shauth | Not in the scope | 2026-11-14 |
| remote.zeit.shvpn | Not in the scope | 2026-11-14 |
| resolve.zeit.sh | Not in the scope | 2026-11-14 |
| restauracemincovna.zeit.sh | Not in the scope | 2026-11-14 |
| retail.zeit.sh | Not in the scope | 2026-11-14 |
| rhinoviruses.zeit.sh | Not in the scope | 2026-11-14 |
| root.zeit.sh | Not in the scope | 2026-11-14 |
| rx.zeit.sh | Not in the scope | 2026-11-14 |
| searchportal.zeit.sh | Not in the scope | 2026-11-14 |
| searchportal-dev.zeit.shdev | Not in the scope | 2026-11-14 |
| searchportal-qa.zeit.shtest | Not in the scope | 2026-11-14 |
| secure.zeit.sh | Not in the scope | 2026-11-14 |
| server.zeit.sh | Not in the scope | 2026-11-14 |
| server1.zeit.sh | Not in the scope | 2026-11-14 |
| servers.zeit.sh | Not in the scope | 2026-11-14 |
| shop.zeit.sh | Not in the scope | 2026-11-14 |
| signin.zeit.shauth | Not in the scope | 2026-11-14 |
| signup.zeit.sh | Not in the scope | 2026-11-14 |
| simple-now-app.zeit.sh | Not in the scope | 2026-11-14 |
| sin.zeit.sh | Not in the scope | 2026-11-14 |
| sip.zeit.sh | Not in the scope | 2026-11-14 |
| sitecore.zeit.sh | Not in the scope | 2026-11-14 |
| slack-members.zeit.sh | Not in the scope | 2026-11-14 |
| slacklack-members.zeit.sh | Not in the scope | 2026-11-14 |
| slot-demos.zeit.sh | Not in the scope | 2026-11-14 |
| wildcard.slot-demos.zeit.sh | Not in the scope | 2026-11-14 |
| smtp.zeit.shmail | Not in the scope | 2026-11-14 |
| space-mining.zeit.sh | Not in the scope | 2026-11-14 |
| spf.zeit.sh | Not in the scope | 2026-11-14 |
| spr-landing.zeit.sh | Not in the scope | 2026-11-14 |
| sql.zeit.sh | Not in the scope | 2026-11-14 |
| ssl.zeit.sh | Not in the scope | 2026-11-14 |
| sslvpn.zeit.shvpn | Not in the scope | 2026-11-14 |
| sso.zeit.shauth | Not in the scope | 2026-11-14 |
| stage.zeit.shstaging | Not in the scope | 2026-11-14 |
| staging.zeit.shstaging | Not in the scope | 2026-11-14 |
| static.zeit.sh | Not in the scope | 2026-11-14 |
| static-demos.zeit.sh | Not in the scope | 2026-11-14 |
| create-react-app.static-demos.zeit.sh | Not in the scope | 2026-11-14 |
| docusaurus.static-demos.zeit.sh | Not in the scope | 2026-11-14 |
| docz.static-demos.zeit.sh | Not in the scope | 2026-11-14 |
| ember.static-demos.zeit.sh | Not in the scope | 2026-11-14 |
378 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.