Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Dropbox bug bounty programs

dropbox.com Updated

Dropbox runs two public programs: an Intigriti bug bounty paying up to $15,000 and an Intigriti disclosure program with no cash rewards. It also owns Dropbox Sign, which runs one more program.

Top reward
$15,000
Intigriti
Programs
3
2 pay cash
Targets in scope
27
6 types, deduplicated
Last change
7 Nov 2026
5 days ago

Where to report

2 programs Dropbox runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Dropbox Bug Bounty

Intigriti · The company-wide program. Pays up to $15,000.
  • Dropbox Bug Bounty

    Intigriti · Bug bounty

    Open

    Top reward

    $15k
    Critical
    $15k (highest)
    High
    $5,000 (highest)
    Medium
    $1,000 (highest)
    Low
    $500 (highest)
    Safe harbor
    Full
  • Dropbox Vulnerability Disclosure Program

    Intigriti · Disclosure only

    Open

    Top reward

    No cash
    Safe harbor
    Full
    First response
    2 days promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

Companies Dropbox owns

1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.

What is in scope

27 targets across all 3 programs, each listed once with the programs that cover it. 14 excluded.

No target matches. Try part of a host name, such as the company name.

Out of scope 14

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.tigrisdata.com

    Dropbox Bug Bounty

  • *.tigrisdata.io

    Dropbox Bug Bounty

  • community-dev.dropbox.com

    Dropbox Bug Bounty

  • community-stage.dropbox.com

    Dropbox Bug Bounty

  • community.dropbox.com

    Dropbox Bug Bounty

  • replay.dropbox.com

    Dropbox Bug Bounty

  • com.dropbox.paper

    Dropbox Bug Bounty

  • 1126623662

    Dropbox Bug Bounty

  • Boxcryptor

    Dropbox Bug Bounty

  • Dropbox Capture macOS Desktop App

    Dropbox Bug Bounty

  • Dropbox Capture Windows Desktop App

    Dropbox Bug Bounty

  • Dropbox Passwords

    Dropbox Bug Bounty

  • Formswift

    Dropbox Bug Bounty

  • Third-party systems or domains referencing Dropbox

    Dropbox Vulnerability Disclosure Program

Recent changes

Reward and scope changes across every Dropbox program, newest first.

All changes · RSS feed

Recent CVEs

Published vulnerabilities in Dropbox products, from the NVD.

Search NVD
  • CVE-2026-28809 Medium

    XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their contents into processed SAML documents, and potentially perform SSRF via crafted SAML messages. esaml parses attacker-controlled SAML messages using xmerl_scan:string/2 before signature verification without disabling XML entity expansion. On Erlang/OTP v

  • CVE-2024-5924 High

    Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Dropbox Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of shared fold

  • CVE-2024-25718 Critical

    In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.

  • CVE-2022-4768 Medium

    A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injection. It is possible to launch the attack remotely. The name of the patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to app

  • CVE-2022-26181 High

    Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108.

  • CVE-2019-12171 High

    Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful login or new account creation. These are not securely freed in the running process.

  • CVE-2018-20819 High

    io/ZlibCompression.cc in the decompression component in Dropbox Lepton 1.2.1 allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact by crafting a jpg image file. The root cause is a missing check of header payloads that may be (incorrectly) larger than the maximum file size.

  • CVE-2018-20820 Medium

    read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows attackers to cause a denial-of-service (application runtime crash because of an integer overflow) via a crafted file.

About this page

This page gathers every public program listed under dropbox.com and the companies Dropbox owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Dropbox.

Something wrong or missing? Report a correction.