Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

1Password bug bounty programs

1password.com Updated

1Password runs one public program: a HackerOne bug bounty paying up to $30,000.

Top reward
$30,000
HackerOne
Programs
1
1 pays cash
Targets in scope
4
3 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program 1Password runs.

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

4 targets. 4 excluded.

  • http://--your-own-1password-account--.1password.com

    Web Critical

  • https://events.1password.com/api

    APIs Critical

  • <Your own 1Password account> —> Latest stable, beta, or nightly Browser Extension (Chrome, Brave, Firefox, Edge, and Safari)

    Products and areas Critical

  • <Your own 1Password account> —> Latest stable, beta, or nightly Command Line Interface (CLI)

    Products and areas Critical

No target matches. Try part of a host name, such as the company name.

Out of scope 4

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.agilebits.com

  • https://support.1password.com

  • https://www.1password.com

  • All other domains, subdomains, and 1Password Accounts that are not owned by you, including accounts where you are a user but not the owner, are out of scope.

Recent changes

Reward and scope changes across every 1Password program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in 1Password products, from the NVD.

Search NVD
  • CVE-2024-42219 High

    1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is insufficient.

  • CVE-2024-42218 Medium

    1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.

  • CVE-2022-32550 Medium

    An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to create connections to the 1Password service. In specific circumstances, this issue allowed a malicious server to convince a 1Password app or integration it is communicating with the 1Password service.

  • CVE-2022-29868 Medium

    1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate secrets from 1Password provided that 1Password is running and is unlocked. Affected secrets include vault items and derived values used for signing in to 1Password.

  • CVE-2021-41795 Medium

    The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass. By targeting a vulnerable component of this extension, a malicious web page could read a subset of 1Password vault items that would normally be fillable by the user on that web page. These items are usernames and passwords for vault items associated with its domain, usern

  • CVE-2020-18173 High

    A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code.

  • CVE-2021-36758 Medium

    1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the t

  • CVE-2021-26905 Medium

    1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key.

About this page

This page gathers every public program listed under 1password.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.