Vulnerabilities in Vercel and Cloudflare: Accepted, but No Bounty

Overview

This video shares what naoyashiga learned from reporting vulnerabilities in Vercel and Cloudflare open source projects through HackerOne. After AI-assisted research had earlier earned a bounty of just under ¥10,000, the author aimed for programs with bigger rewards. The findings were confirmed, but someone else had reported the same issues first, so no bounty was paid. The vulnerabilities themselves are not described because they have not been disclosed yet.

Key Points

• HackerOne takes care of tedious parts of reporting, such as where to communicate, how rewards are paid and finding companies with bounty programs. Most programs involve black-box testing of apps and websites, but some also pay for open source.
• Cloudflare’s public program covers every repository in its GitHub organization (558 public repositories), with rewards by severity from $250–$500 for low up to $4,000–$10,000 for critical. Hacktivity shows past reports and payouts.
• Vercel’s open source program has a narrower scope, including projects such as Turborepo and Next.js, split into tiers 1 to 3. Tier 1, which includes Next.js, pays the most.
• Bounties go to the first reporter, so the duplicate reports were closed. Duplicates are sometimes handled as a collaboration, but not always, and the outcome stays unclear until the earlier report is disclosed.
• HackerOne’s alpha AI report-writing feature was slightly off target, so the English reports were written with Claude Code instead. One closed program becomes visible to anyone who submitted at least one report in the past month.

Chapters

• 0:00 Introduction
• 0:34 Introducing HackerOne
• 1:45 Bounties for OSS vulnerability reports too
• 3:10 What Cloudflare’s bounty covers
• 3:38 What Vercel’s bounty covers
• 5:03 Why no bounty was paid
• 6:31 Lessons from actually using HackerOne