listmonk bug bounty programs
listmonk.app Updated
Listmonk runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 11
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program listmonk runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
listmonk
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
11 targets. 6 excluded.
-
https://listmonk.app
Web
-
Bounce and webhook processing, where a remote mail server or delivery provider supplies the input
Products and areas
-
Campaign templating and message rendering, on both the HTML and plain-text paths
Products and areas
-
Media upload and storage, covering the filesystem and object-storage backends and the URLs they hand back
Products and areas
-
SMTP and messenger configuration handling, since the instance holds the credentials for whatever actually sends the mail
Products and areas
-
Subscriber import and export, including file parsing on the way in and query handling on the way out
Products and areas
-
The admin panel in full: authentication, session handling, every settings page and every action an operator can take from it
Products and areas
-
The public-facing pages: subscription forms, the double opt-in confirmation flow, preference management and unsubscribe links, none of which need an account at all
Products and areas
-
The published policy asks for security vulnerabilities in listmonk through GitHub security advisories, and pairs that with an explicit list of classes it has decided are not vulnerabilities. Everything inside the product and outside that list is fair game
Products and areas
-
The user and role model, covering per-list permissions and what one non-superadmin account can reach of another's data
Products and areas
-
The whole HTTP API, including the subscriber, list, campaign, template and media endpoints, and the API-key authentication in front of them
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
CSV formula injection in exports, ruled out by name
-
Operator configuration, including an instance deliberately published without authentication in front of it
-
Regular-expression denial of service in the templating engine, ruled out by name
-
SQL injection through the subscriber-query feature, a deliberate capability the admin role is meant to have. The project rules it out by name
-
Stored cross-site scripting delivered through SVG uploads, ruled out by name in the same published list
-
Upstream Go libraries and Postgres itself, unless listmonk's own use of them is what makes the defect reachable
Recent changes
Reward and scope changes across every listmonk program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under listmonk.app: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.