Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

BitTorrent bug bounty programs

bittorrent.com Updated

BitTorrent runs one public program: a HackerOne bug bounty paying up to $5,000 (paused).

Top reward
Not published
Programs
1
1 pays cash
Targets in scope
0
Not listed publicly
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program BitTorrent runs.

  • BTFS

    HackerOne · Bug bounty

    Paused

    Top reward

    $5,000
    Critical
    $5,000
    High
    $2,000
    Medium
    $750
    Low
    $100

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

What each program lets you test.

None of these programs lists its targets publicly. Each program's policy says what you may test.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.bittorrent.com

  • *.bt.co

  • *.readme.io

  • *.readme.io,*.bittorrent.com,*.bt.co

  • https://github.com/ipfs

Recent changes

Reward and scope changes across every BitTorrent program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in BitTorrent products, from the NVD.

Search NVD
  • CVE-2018-25042 Medium

    A vulnerability classified as critical has been found in uTorrent. This affects an unknown part. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component.

  • CVE-2018-25043 Medium

    A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

  • CVE-2018-25044 Medium

    A vulnerability, which was classified as critical, has been found in uTorrent. This issue affects some unknown processing of the component Guest Account. The manipulation leads to privilege escalation. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

  • CVE-2020-8437 High

    The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attacker to cause a denial of service.

  • CVE-2015-5685 High

    The lazy_bdecode function in BitTorrent DHT bootstrap server (bootstrap-dht ) allows remote attackers to execute arbitrary code via a crafted packet, related to "improper indexing."

  • CVE-2015-5474 High

    BitTorrent and uTorrent allow remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (2) magnet protocol.

  • CVE-2015-2846 High

    BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link.

  • CVE-2014-8515 Medium

    The web interface in BitTorrent allows remote attackers to execute arbitrary commands by leveraging knowledge of the pairing values and a crafted request to port 10000.

About this page

This page gathers every public program listed under bittorrent.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.