Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

The Monero Project bug bounty programs

getmonero.org Updated

The Monero Project runs two public programs: a HackerOne disclosure program with no cash rewards and a Sorona bug bounty.

Top reward
Not published
Programs
2
1 pays cash
Targets in scope
9
3 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Monero

HackerOne · A disclosure program: you report for credit, not cash.
  • Monero

    HackerOne · Disclosure only

    Open

    Top reward

    No cash
    First response
    9 hours average
  • Monero

    Sorona · Bug bounty

    Open

    Top reward

    Not published
    Safe harbor
    Partial
    First response
    24 hours promised

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

9 targets across all 2 programs, each listed once with the programs that cover it. 12 excluded.

  • https://www.getmonero.org

    Web

    Covered by Sorona

  • the Monero applications, which are written in C++, with some C and assembly, and QtQuick for the Monero GUI

    Source code

    Covered by HackerOne

  • Consensus and verification in full: RingCT, Bulletproofs, ring signature and key image checks, transaction validation, and the difficulty and emission rules

    Products and areas

    Covered by Sorona

  • monerod, the reference full node: the peer-to-peer stack it exposes to unauthenticated remote peers, block and transaction relay, the blockchain database and reorganisation handling

    Products and areas

    Covered by Sorona

  • The HackerOne policy points at one list: "Only the projects listed in our Vulnerability Response Process are considered in scope". The VRP describes those as the Monero applications, written in C++ with some C and assembly, plus the QtQuick GUI, so the declaration is the codebase rather than a set of named subsystems

    Products and areas

    Covered by Sorona

  • The Monero GUI, the QtQuick front end the VRP names alongside the C++ applications

    Products and areas

    Covered by Sorona

  • The RPC surfaces on both daemon and wallet, including the restricted mode a public node runs

    Products and areas

    Covered by Sorona

  • The supporting code the applications carry, including the cryptographic primitives and the serialization layer every untrusted peer message and RPC body is parsed through

    Products and areas

    Covered by Sorona

  • The wallet, covering monero-wallet-cli, monero-wallet-rpc and the wallet library beneath both: key derivation, output scanning, subaddresses, multisig and transaction construction

    Products and areas

    Covered by Sorona

No target matches. Try part of a host name, such as the company name.

Out of scope 12

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Any expectation of a fiat award or a fixed figure: payment is XMR only, from a donated pool that shrinks as awards are made, so a valid report can be worth less than the same report was last quarter

    Sorona

  • Any project not listed in the Vulnerability Response Process

    Sorona

  • CSRF / XSS RELATED REPORTS

    HackerOne

  • CSRF and XSS reports of any kind: the policy states in capitals that they will be closed as Not Applicable

    Sorona

  • metadata leaks from volunteer hosting infrastructure

    HackerOne

  • Metadata leaks from volunteer-run hosting infrastructure, which is not the codebase the VRP covers

    Sorona

  • Reports with undisclosed AI usage, which are disqualified outright rather than downgraded

    Sorona

  • Speculative findings with no reproduction, which draw a permanent ban rather than a polite closure

    Sorona

  • The live sites

    HackerOne

  • the Monero forum

    HackerOne

  • Vulnerabilities in the project's Jekyll static website

    Sorona

  • website vulnerabilities

    HackerOne

Recent changes

Reward and scope changes across every The Monero Project program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under getmonero.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.