Skip to content
Sign in

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:Vercel
Status
Severity
Weakness
Year
Bounty paid1
Access stated
  • No account0
  • A user account0
  • Admin or privileged0
Access needed
  • No account0
  • A user account0
  • A privileged role0
  • Admin0
  • Physical or local access0
  • Not clear from the report0
Clear filters16 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
Revoked deployment collaborator regains access to private comments after active collaborator interaction#3852102ValidInput Validation and LogicMedium2026-10-29$1,02655
Open redirect vuln on login#608031Not checked yetOpen Redirect–––45
through %09 Character the attacker is able to steal Github Token [ Account Takeover ]#763058Not checked yetOpen Redirect–––44
Gitlab Oauth Misconfiguration Lead To Account Takeover#541701Not checked yetNo weakness recorded–––39
Open Redirect on Gitllab Oauth leading to Acount Takeover#677617Not checked yetOpen Redirect–––34
CSRF On Connect Account With Github Lead To Account Takeover#542047Not checked yetCross-Site Request Forgery–––29
Stored XSS on Zeit.co user profile#541737Not checked yetCross-site Scripting–––21
Stored Cross-site scripting#541710Not checked yetCross-site Scripting–––13
User personal data disclosure via API#630235Not checked yetInformation Disclosure–––12
[Fix Bypass #541631] Open redirect on Signup#541948Not checked yetOpen Redirect–––9
Access control bypass leads to domain information disclosure#630192Not checked yetAuthentication–––8
Open redirection in https://zeit.co/login?next=#618214Not checked yetOpen Redirect–––7
Stored XSS in profile page#541853Not checked yetCross-site Scripting–––7
[serve] Path Traversal#510043Not checked yetFile and Path Handling–––5
Unauthorized admission to any team in zeit.co#681882Not checked yetAuthentication–––3
Reflected DOM-Based XSS On Due Lack Filter On Parameter ?next#545121Not checked yetCross-site Scripting–––3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in