Vercel Paid $1 Million to Hackers to Strengthen WAF.

Vercel has disclosed more detail on a major security initiative, revealing that it paid $1 million to hackers and security researchers to help strengthen its web application firewall (WAF). The company said the effort focused on defending against React2Shell and included the first public disclosure of a runtime mitigation layer added to its protection stack.

Key details from the announcement:

• Vercel worked with HackerOne bounty hunters and security researchers as part of the initiative.
• The company said 116 participants contributed, including several named researchers and 110 additional contributors.
• The program was designed to identify weaknesses and improve Vercel’s firewall defenses.
• Vercel publicly disclosed a runtime mitigation layer for the first time.
• The work was tied to defenses against React2Shell, a security threat referenced in the announcement.

For small business owners and builders, this matters because many rely on hosted platforms to manage application security they cannot staff internally. Stronger default protections at the platform level can reduce risk for teams shipping web apps with limited security resources.