Matomo bug bounty programs
matomo.org Updated
Matomo runs three public programs: a HackerOne bug bounty paying up to $13,000, a self-hosted bug bounty paying up to $13,000 and a Sorona bug bounty paying up to $971.
- Top reward
- $13,000
- HackerOne
- Programs
- 3
- 3 pay cash
- Targets in scope
- 22
- 5 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Matomo
HackerOne · Pays the most of the 3 programs: up to $13,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Matomo
HackerOne · Bug bounty |
$13k (highest) | $1,777 (highest) | $777 | $333 | $13,000 | Partial | – | 12 hours average | Open |
|
Piwik
Self-hosted · Bug bounty |
$13k | – | – | – | $13,000 | Partial | – | 24 hours promised | Open |
|
Matomo
Sorona · Bug bounty |
– | – | $971 (highest) | $416 (highest) | $971 | Partial | – | 24 hours promised | Open |
-
- Critical
- $13k (highest)
- High
- $1,777 (highest)
- Medium
- $777
- Low
- $333
- Safe harbor
- Partial
- First response
- 12 hours average
-
- Critical
- $13k
- High
- –
- Medium
- –
- Low
- –
- Safe harbor
- Partial
- First response
- 24 hours promised
-
- Critical
- –
- High
- –
- Medium
- $971 (highest)
- Low
- $416 (highest)
- Safe harbor
- Partial
- First response
- 24 hours promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
22 targets across all 3 programs, each listed once with the programs that cover it. 35 excluded.
-
Authentication and session handling as shipped, including the login, password reset and two-factor flows
Products and areas
Covered by Sorona
-
Everything else under the matomo-org and innocraft GitHub organisations, bounty-eligible but capped at High
Products and areas
Covered by Sorona
-
Matomo Cloud on the per-account *.matomo.cloud subdomains, tested on an instance you set up yourself, without automated tooling and without disturbing a live one
Products and areas
Covered by Sorona
-
That release in full, meaning the whole application: the tracking endpoint every measured site posts to, the reporting API, the web UI and the administration area
Products and areas
Covered by Sorona
-
The archiving and cron pipeline, the import and export paths, and the installer and updater that run against a live database
Products and areas
Covered by Sorona
-
The multi-site and user-permission model: sites, users, roles, auth tokens, and every check meant to keep one site's analytics away from another's
Products and areas
Covered by Sorona
-
The official Docker project at github.com/matomo-org/docker, a Critical-severity asset in its own right
Products and areas
Covered by Sorona
-
The plugin machinery itself, together with the official first-party plugins by Matomo and InnoCraft, premium ones included, which the program prices at Critical through the plugins.matomo.org/developer asset rows
Products and areas
Covered by Sorona
-
The program's own definition of the target: an issue in the latest official release at builds.matomo.org/latest.zip as installed on a typical server, possibly using any official plugin by Matomo or InnoCraft from the Marketplace. The matomo-org/matomo source-code asset carries that at Critical severity
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 35
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
api.matomo.org
HackerOne
-
forum.matomo.org
HackerOne
-
matomo.org
HackerOne
-
plugins.matomo.org
HackerOne
-
shop.matomo.org
HackerOne
-
Anything already fixed in the code, even where the fix has not yet shipped in a release
Sorona
-
Application Errors on pages
Self-hosted
-
Blind Server-Side Request Forgery
Self-hosted
-
Brute force, DoS, DDoS, phishing, text injection, or social engineering attacks.
Self-hosted
-
CLI is out out scope (including the Matomo console commands)
Self-hosted
-
Clickjacking
Self-hosted
-
CORS related issues in any of our *.matomo.org websites.
Self-hosted
-
Crime/beast attack and Lack of HTTP security headers (CSP, X-XSS, etc.)
Self-hosted
-
Critical-band claims anywhere outside matomo-org/matomo, the official Docker project and the two official plugin developer accounts, since the rest of both organisations caps at High
Sorona
-
Findings derived only from code reading, scanners, or AI output with no reproduction on a running instance
Sorona
-
forum.matomo.org, which runs Discourse and belongs on Discourse's own bug bounty rather than this one
Sorona
-
HSTS or CSP headers
Self-hosted
-
Information disclosure
Self-hosted
-
Issues related to world writable files in a shared hosting environment
Self-hosted
-
Missing cookie flags on non-sensitive cookies.
Self-hosted
-
Open Directory Listing
Self-hosted
-
Output from automated scans
Self-hosted
-
Path disclosure
Self-hosted
-
Race conditions to bypass limits/quotas.
Self-hosted
-
Security issues as a result of running a Matomo instance without HTTPS
Self-hosted
-
SPF, DMARC records missing
Self-hosted
-
The Matomo Mobile 2 Android and iOS apps, which are not bounty-eligible at all and take only critical issues compromising the token
Sorona
-
The project's own web properties: matomo.org, api.matomo.org, shop.matomo.org, and plugins.matomo.org as a platform, as opposed to the first-party plugins it distributes
Sorona
-
Third-party Marketplace plugins written by anyone other than Matomo or InnoCraft, which pay nothing regardless of severity. This is the exclusion that most changes a researcher's expected value
Sorona
-
Users with super user privileges can post arbitrary JavaScript
Self-hosted
-
Version disclosure
Self-hosted
-
Vulnerabilities affecting users of outdated browsers or platforms.
Self-hosted
-
Vulnerabilities caused by not applying Matomo security best practises
Self-hosted
-
Vulnerabilities due to an older version of PHP, or MySQL (or MariaDB), or in the web server (Apache/Nginx), or Operating System (Linux/Windows).
Self-hosted
-
Vulnerabilities in third party plugins (not authored by Matomo nor InnoCraft)
Self-hosted
Recent changes
Reward and scope changes across every Matomo program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Matomo products, from the NVD.
-
CVE-2025-4415 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.
-
CVE-2025-4415 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.
-
CVE-2023-6923 Medium
The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user
-
CVE-2023-6923 Medium
The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user
-
CVE-2022-33156 Medium
The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.
-
CVE-2022-33156 Medium
The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.
-
CVE-2020-29578 Critical
The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
-
CVE-2020-29578 Critical
The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
About this page
This page gathers every public program listed under matomo.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.