Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

DigitalOcean, LLC. bug bounty programs

digitalocean.com Updated

DigitalOcean, LLC. runs one public program: an Intigriti bug bounty paying up to $10,000. It also owns cloudways.com, which runs one more program.

Top reward
$10,000
Intigriti
Programs
2
2 pay cash
Targets in scope
26
4 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program DigitalOcean, LLC. runs itself.

  • DigitalOcean

    Intigriti · Bug bounty

    Open

    Top reward

    $10k
    Critical
    $10k
    High
    $4,000
    Medium
    $1,500
    Low
    $450
    Safe harbor
    Full
    First response
    2 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

Companies DigitalOcean, LLC. owns

1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.

What is in scope

26 targets across all 2 programs, each listed once with the programs that cover it. 41 excluded.

No target matches. Try part of a host name, such as the company name.

Out of scope 41

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.agents-internal.do-ai.run

    DigitalOcean

  • *.db.ondigitalocean.com

    DigitalOcean

  • *.db1.ondigitalocean.com

    DigitalOcean

  • *.digitaloceanspaces.com

    DigitalOcean

  • *.doserverless-dev3.io

    DigitalOcean

  • *.doserverless.co

    DigitalOcean

  • *.k8s.ondigitalocean.com

    DigitalOcean

  • *.ondbaasdev.com

    DigitalOcean

  • *.ondigitalocean.app

    DigitalOcean

  • *.onstagingocean.app

    DigitalOcean

  • registry.digitalocean.com/*

    DigitalOcean

  • *.snapshooter.com

    DigitalOcean

  • anchor.digitalocean.com

    DigitalOcean

  • brand.digitalocean.com

    DigitalOcean

  • cloudsupport.digitalocean.com

    DigitalOcean

  • deploy.digitalocean.com

    DigitalOcean

  • email.digitalocean.com

    DigitalOcean

  • events.digitalocean.com

    DigitalOcean

  • go.digitalocean.com

    DigitalOcean

  • groove.digitalocean.com

    DigitalOcean

  • helpdesk.digitalocean.com

    DigitalOcean

  • ideas.digitalocean.com

    DigitalOcean

  • investor.digitalocean.com

    DigitalOcean

  • investors.digitalocean.com

    DigitalOcean

  • ir.digitalocean.com

    DigitalOcean

  • mirrors.digitalocean.com

    DigitalOcean

  • pilot.digitalocean.com

    DigitalOcean

  • rewards.digitalocean.com

    DigitalOcean

  • segment.digitalocean.com

    DigitalOcean

  • status.digitalocean.com

    DigitalOcean

  • tracking.digitalocean.com

    DigitalOcean

  • waves.digitalocean.com

    DigitalOcean

  • Assets created by other DigitalOcean customers

    DigitalOcean

  • https://github.com/digitalocean/action-doctl

    DigitalOcean

  • https://github.com/digitalocean/do-markdownit

    DigitalOcean

  • https://github.com/digitalocean/go-nbd

    DigitalOcean

  • https://github.com/digitalocean/godo

    DigitalOcean

  • https://github.com/digitalocean/pydo

    DigitalOcean

  • https://github.com/digitalocean/terraform-provider-digitalocean

    DigitalOcean

  • Marketplace Apps and Add-Ons

    DigitalOcean

  • Other DigitalOcean open source projects not listed

    DigitalOcean

Recent changes

Reward and scope changes across every DigitalOcean, LLC. program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in DigitalOcean, LLC. products, from the NVD.

Search NVD
  • CVE-2025-59717 Medium

    In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).

  • CVE-2020-36569 Critical

    Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.

  • CVE-2022-29444 Medium

    Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack.

About this page

This page gathers every public program listed under digitalocean.com and the companies DigitalOcean, LLC. owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming DigitalOcean, LLC..

Something wrong or missing? Report a correction.