This is Bugbop's Bug Bounty program, hosted on Bugbop itself!
Testing the platform? Use the test program
Want to try Bugbop out, or see how reports work? Use the test program: https://bugbop.com/programs/555f7538-f1de-486c-b0d3-8c9b1ba79eac
Never file test reports on a real program, including this one. A real person has to read and close every one, and repeat offenders get banned.
We're excited to invite security researchers from all backgrounds to help us make Bugbop a more secure platform for everyone.
Program Scope
Please read this whole page before submitting. Most rejected reports are for things listed below.
In-Scope Assets
Out-of-Scope Assets
- Any services hosted by third parties, unless they impact the security of our primary assets
- Denial of Service (DoS) attacks
- Social engineering attacks
Vulnerabilities We're Interested In
- Cross-Site Scripting (XSS)
- SQL Injection
- Authentication bypass
- Privilege escalation
- Remote Code Execution (RCE)
- Security misconfigurations
- Server-side request forgery (SSRF)
Vulnerabilities Out-of-Scope
- Anything that starts from the victim's inbox, device or an existing session. That includes password reset links, invite links, confirmation and unsubscribe tokens, sessions staying alive after a 2FA change, the remember-me cookie, and reusing a 2FA QR code. We use Devise and devise-two-factor with their default behaviour and will not override it for these.
- Email enumeration. Sign-up, password reset and confirmation tell you whether an address is registered. We know, and we won't pay for it.
- Username enumeration, duplicate accounts via email address normalisation, and username squatting.
- SPF, DMARC, CAA and other DNS records.
- CSP configuration, including unsafe-inline and unsafe-eval.
- Missing HTTP security headers (unless they lead to a proven vulnerability).
- Published source maps and anything else already public on GitHub.
- Missing rate limits without a demonstrated impact.
- Links that users set themselves (profile links, program site) pointing somewhere unpleasant.
- Hyperlink injection in emails.
- Issues solely affecting outdated browsers.
- Reports from automated tools without clear evidence of impact.
- Errors from the app that don't have a material security impact, including 500s and UX bugs.
- The AI triage bot's severity and scope calls are suggestions, not decisions. Getting the bot to say something wrong is not a bug.
- Metadata in uploaded images.
- Any physical attempts against Bugbop property or data centers.
Attachments
Uploads are served through Cloudflare's image resizer at unguessable URLs. Files are re-encoded and stripped of metadata on the way out. A resized URL still working after a role change or program removal is an accepted risk.
Intended Behaviour
These are deliberate. Please don't report them.
- Restricted programs show their overview, name and logo to everyone. That is how Request Access works. Subscribing to one only sends you public program changes.
- Triagers can invite and remove Bug Hunters and approve access requests.
- Viewers can read internal notes and bounty amounts.
- Hunters can edit their own reports after triage. Every change is versioned.
- Hunters removed from a program keep access to their own reports.
- Hunters closed as a duplicate see the title of the report they duplicated.
- The activity feed shows hunter usernames and bounty amounts to program members.
- Invites are sent to an email address but are not bound to it.
- A program with no reports can be deleted by its admins.
- Disabling two-factor authentication needs only a signed-in session and the account password.
- Bugbop has no external link warning. Reports about links not showing one are not applicable.
Rate Limits & Testing Constraints
- Limit API requests to no more than 10 requests per minute
- Avoid testing that triggers excessive emails or notifications (max 5 per hour)
- Limit login/authentication attempts to 10 per hour
- Avoid any testing that could impact system availability or other users
How We Pay
Our rule of thumb: if it's security related and we make a fix for it, we pay a bounty. The ranges are at the bottom of this page. Most Lows pay $20.
- Critical e.g. RCE, database access
- High e.g. privilege escalation, significant data exposure
- Medium e.g. XSS on bugbop.com, minor API issues
- Low e.g. information disclosure without direct impact
Severity is judged on what the report demonstrates, not on what it claims. Reports without clear security implications or that require unrealistic attack scenarios will not be rewarded.
Submission Guidelines
- Provide clear, step-by-step instructions to reproduce the vulnerability.
- Include screenshots, videos, or code snippets where possible.
- Test only on your own accounts; do not access others' data.
- Be respectful of our users' privacy and our systems' stability.
Our Commitment
- We acknowledge reports within 48 hours.
- We give a triage decision within 10 business days.
- Accepted reports are paid at triage, not at fix. Fixes land on our own schedule.
Legal Safe Harbor
This program follows a "safe harbor" approach. As long as your research is conducted responsibly and within the program's scope, we consider it authorized. If legal questions arise, we'll work with you to understand and resolve them.
