Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Countly bug bounty programs

countly.com Updated

Countly runs one public program: a Sorona bug bounty.

Top reward
Not published
Programs
1
1 pays cash
Targets in scope
10
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Countly runs.

  • Countly

    Sorona · Bug bounty

    Open

    Top reward

    Not published
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

10 targets. 6 excluded.

  • https://countly.com

    Web

  • Authentication and session handling for the dashboard, plus the auth tokens and API keys that stand in for a session on the API

    Products and areas

  • Countly's SECURITY.md sets the target as the repository itself: "Bounty assessment is made against the current code in this repository." That repository is Countly/countly-server, and any software security bug in it at medium severity or above is stated to earn a reward

    Products and areas

  • Data export, report generation and the raw-data API, which move a whole behavioural dataset out of the instance

    Products and areas

  • The dashboard: its views, its widgets, and every place operator-supplied or event-supplied strings are rendered back

    Products and areas

  • The member, group and permission model, and the app-level boundary meant to keep one application's data away from another's operators

    Products and areas

  • The Node.js API server: the write path at /i and /i/bulk, the read path at /o, and the request parsing and validation in front of both

    Products and areas

  • The plugin framework and the plugins enabled by default, meaning those listed in plugins/plugins.default.json

    Products and areas

  • The query layer that turns dashboard filters and API parameters into MongoDB queries and aggregations

    Products and areas

  • The SDK ingest surface, which takes event, session, crash and user-property data from mobile and web SDKs across the open internet without authentication

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Additional instances of a vulnerability class already being remediated, including work visible only in an open pull request or an unmerged branch

  • Any plugin not listed in plugins/plugins.default.json, which the policy states are out of scope regardless of what they do

  • Countly's hosted Enterprise offering, which is not "the current code in this repository"

  • Low-severity findings, which the policy states earn no bounty reward

  • MongoDB, Node.js and the npm dependencies Countly builds on, which belong to their own projects

  • XSS without demonstrated execution in an authenticated dashboard session

Recent changes

Reward and scope changes across every Countly program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under countly.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.