$1 million hacker challenge for Vercel Sandbox
Vercel launched a two-week public bug bounty program offering up to $1 million to researchers who can demonstrate sandbox escapes in Vercel Sandbox, a Firecracker microVM-based isolation system for untrusted code.
Vercel announced a two-week public HackerOne challenge offering up to $1,000,000 in bounties for researchers who can escape the isolation boundary of Vercel Sandbox, a system designed to run untrusted code securely. The program targets vulnerabilities that allow reading or modifying another tenant's data, with maximum rewards of $50,000 per qualifying report. Researchers must demonstrate a live proof of concept to receive payment, as static analysis alone will not suffice. The program runs from the announcement date through September 1, 2026, or until the reward pool is exhausted.
Vercel Sandbox isolates untrusted code using Firecracker microVMs, each with a dedicated guest kernel, running on bare-metal EC2 hosts. The security boundary is enforced both by the microVM and host-side network controls, including a sandbox firewall that intercepts and validates outbound TCP and DNS traffic. The system assumes fully hostile code, granting root access within the container and kernel access inside the microVM, while preventing modifications to the host or other tenants. Vulnerabilities in scope include compute boundary escapes to the host or other sandboxes, network boundary breaches, and unauthorized data exfiltration.
The bounty program explicitly excludes container namespace escapes that remain within the Firecracker guest OS, as namespaces are considered a developer-experience feature rather than the security boundary. Reports must demonstrate a clear breach of the sandbox boundary, with payouts determined by the maximum demonstrable impact and assigned by Vercel's triage team. Known duplicate classes and detailed scope are listed on the HackerOne program page, which also provides instructions for reproducing findings using the @vercel/sandbox SDK.
Vercel will triage reports throughout the program and for one month after its closure, paying bounties, implementing fixes, and crediting researchers for confirmed findings. Techniques discovered during the program will be incorporated into permanent improvements to the sandbox boundary. After the challenge concludes, Vercel plans to publish a follow-up detailing the vulnerabilities found and the fixes deployed, with HackerOne facilitating the program's execution.