Doppler bug bounty programs
doppler.com Updated
Doppler runs two public programs: a HackerOne bug bounty paying up to $10,000 and a Sorona bug bounty paying up to $3,125.
- Top reward
- $10,000
- HackerOne
- Programs
- 2
- 2 pay cash
- Targets in scope
- 14
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Doppler
HackerOne · Pays the most of the 2 programs: up to $10,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Doppler
HackerOne · Bug bounty |
$10k (highest) | $2,500 | $750 | $250 | $10,000 | Full | – | 15 hours average | Open |
|
Doppler CLI
Sorona · Bug bounty |
– | $3,125 (highest) | $938 (highest) | $313 (highest) | $3,125 | Partial | – | 2 days promised | Open |
-
- Critical
- $10k (highest)
- High
- $2,500
- Medium
- $750
- Low
- $250
- Safe harbor
- Full
- First response
- 15 hours average
-
- Critical
- –
- High
- $3,125 (highest)
- Medium
- $938 (highest)
- Low
- $313 (highest)
- Safe harbor
- Partial
- First response
- 2 days promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
14 targets across all 2 programs, each listed once with the programs that cover it. 12 excluded.
-
doppler secrets download, template rendering, and every file-writing path that lands plaintext secrets on disk
Products and areas
Covered by Sorona
-
github.com/DopplerHQ/cli as a named SOURCE_CODE asset, bounty-eligible and submission-eligible at a maximum severity of critical and on the program since 2020. Its scope instruction pulls in the Doppler API the client talks to, and the compiled doppler binary is carried as a second bounty-eligible downloadable-executable asset
Products and areas
Covered by Sorona
-
Local credential storage: the token store, the keyring integration, and the permissions the CLI sets on its own config and cache files
Products and areas
Covered by Sorona
-
Secret fetch, cache and injection, above all doppler run, which puts secrets straight into a child process environment
Products and areas
Covered by Sorona
-
Service tokens, service accounts and the login flow the CLI drives, including the non-interactive auth path used from CI and CD runners
Products and areas
Covered by Sorona
-
The full command surface: doppler run, doppler secrets, doppler configs, doppler setup and the rest of the tree, along with flag parsing and the config file the CLI maintains
Products and areas
Covered by Sorona
-
The TLS and API client: certificate validation, fallback behaviour when the preferred connection path fails, and the handling of whatever the API returns
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 12
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
community.doppler.com
HackerOne
-
docs.doppler.com
HackerOne
-
doppler.com
HackerOne
-
http://calendly.com/doppler/enterprise
HackerOne
-
support.doppler.com
HackerOne
-
Denial of service, brute forcing, spamming, social engineering and physical attacks
Sorona
-
Duplicates. First reporter only, and one bounty per underlying root cause however many commands or code paths that cause surfaces on
Sorona
-
github.com/DopplerHQ/awesome-bots, marked eligible_for_bounty: false and eligible_for_submission: false. The program discriminates between its own repositories rather than blanket-covering the org
Sorona
-
https://github.com/DopplerHQ/awesome-bots
HackerOne
-
Known-vulnerable dependencies reported without a working proof of concept showing impact through the CLI
Sorona
-
MFA bypass by way of Google Auth or SAML, which Doppler declares to be intended behaviour
Sorona
-
The web estate: doppler.com, docs.doppler.com, community.doppler.com and support.doppler.com are all out of scope
Sorona
Recent changes
Reward and scope changes across every Doppler program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under doppler.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.