• $200 – $12,000 per vulnerability
  • Safe harbor

Program stats

  • Vulnerabilities rewarded 10
  • Validation within 4 days 75% of submissions are accepted or rejected within 4 days
  • Average payout $1,000 within the last 3 months

Latest hall of famers

Recently joined this program

No technology is perfect and we believe that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting!


For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher which may be appealed if additional evidence of an increased impact can be provided.

We will also leverage CVSS ratings if there is any ambiguity in where the submission falls in the VRT to help maintain the severity and impact of the finding. CVSS generally tracks with the VRT as such:

Severity Level Critical High Medium Low Informational
VRT P1 P2 P3 P4 P5
CVSS v3 10.0-9.0 8.9-7.0 6.9-4.0 <= 3.9 Low Impact <= 3.9 Informational

Note that we will not pay for submissions that count as Informational/P5.

We reserve the right to make any final determination of rating levels for any reported vulnerability.

Scope and rewards

Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please submit through the Bugcrowd Support Portal. We will address your issue as soon as possible.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.