Cal.com bug bounty programs
cal.com Updated
Cal.com runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 13
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Cal.com runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Cal.com
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
13 targets. 6 excluded.
-
https://cal.com
Web
-
Authentication in full, covering password login, SSO and SAML where configured, session issuance and impersonation features
Products and areas
-
Booking creation, rescheduling and cancellation, plus the tokens and links that authorise those actions from an email
Products and areas
-
Payment collection for bookings and the provider integrations behind it
Products and areas
-
Public booking pages, the anonymous surface of the product, including availability lookup and the data a booking page discloses about a user who never authenticated the visitor
Products and areas
-
Team and organisation membership: invitations, roles, and the checks meant to keep one team's bookings and availability out of another's reach
Products and areas
-
The API, both the public API keys used by scripted consumers and the internal endpoints the web application calls
Products and areas
-
The app store and the installed-app framework, where third-party integrations receive credentials and callbacks
Products and areas
-
The calendar integration layer end to end: the OAuth authorisation flow, the storage of refresh tokens and every call the server makes to a connected Google or Microsoft account on a user's behalf
Products and areas
-
The embed, which puts Cal.com inside somebody else's page and inherits that page's origin problems
Products and areas
-
The published policy takes private reports on Cal.com at [email protected] and pairs them with its own out-of-scope list. Inside that boundary it names no component carve-out, so the application as a whole is the target
Products and areas
-
Webhooks and outbound requests the server makes on a user's behalf, including any user-supplied destination URL
Products and areas
-
Workflows, reminders and the email and messaging paths that render user-supplied content
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anything named in the policy's own out-of-scope list, which the project publishes in SECURITY.md and updates independently of this page. Read it first
-
Google, Microsoft and other calendar providers' own systems, which are third-party estates rather than Cal.com code
-
Self-hosting and deployment configuration choices, including an instance run without the environment variables the documentation requires
-
Testing against other users' live booking pages or connected calendars
-
Third-party apps in the app store that are not maintained in the Cal.com repository
-
Upstream dependency issues, unless Cal.com's own use of the dependency is what makes the defect reachable
Recent changes
Reward and scope changes across every Cal.com program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under cal.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.