Mattermost, Inc. bug bounty programs

Mattermost, Inc. programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
MA Mattermost Sorona · Bug bounty	$2,000 (highest)	$750 (highest)	$300 (highest)	$150 (highest)	$2,000	Partial	Required	2 days promised	Open
MP Mattermost Public Bug Bounty Engagement Bugcrowd · Bug bounty	$2,000	$750	$300	$150	$2,000	Full	–	–	Open

• MA

  Mattermost

  Sorona · Bug bounty

  Open

  Top reward

  $2,000

  Critical

  $2,000 (highest)

  High

  $750 (highest)

  Medium

  $300 (highest)

  Low

  $150 (highest)

  Safe harbor

  Partial

  KYC

  Required

  First response

  2 days promised

• MP

  Mattermost Public Bug Bounty Engagement

  Bugcrowd · Bug bounty

  Open

  Top reward

  $2,000

  Critical

  $2,000

  High

  $750

  Medium

  $300

  Low

  $150

  Safe harbor

  Full

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://bugcrowd-*your-own-instance*.cloud.mattermost.com

  Wildcards

  Covered by Bugcrowd

• https://mattermost.com

  Web

  Covered by Sorona

• https://play.google.com/store/search?q=mattermost&c=apps

  Android

  Covered by Bugcrowd

• https://apps.apple.com/us/app/mattermost/id1257222717

  iOS

  Covered by Bugcrowd

• A Mattermost Cloud instance the researcher provisions for themselves at https://bugcrowd-<your-own-instance>.cloud.mattermost.com/

  Products and areas

  Covered by Sorona

• Authentication and session handling across SAML, OpenID Connect, LDAP and AD, MFA, personal access tokens and bot accounts

  Products and areas

  Covered by Sorona

• https://github.com/mattermost/mattermost-plugin-ai

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-boards

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-calls

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-confluence

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-github

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-gitlab

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-jira

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-mscalendar

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-msteams

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-msteams-meetings

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-playbooks

  Products and areas

  Covered by Bugcrowd

• https://github.com/mattermost/mattermost-plugin-zoom

  Products and areas

  Covered by Bugcrowd

• https://mattermost.com/apps/

  Products and areas

  Covered by Bugcrowd

• The brief describes the target as a backend, a webapp, a desktop app and mobile apps for iOS and Android, and names building from source at github.com/mattermost/mattermost as a sanctioned way to stand one up. Self-hosted from source or from the official downloads, that whole product is the asset.

  Products and areas

  Covered by Sorona

• The Mattermost Desktop applications, and Mattermost Mobile for iOS and Android

  Products and areas

  Covered by Sorona

• The plugin framework itself: the plugin API, slash commands, incoming and outgoing webhooks, and the interactive dialog and message-action surface

  Products and areas

  Covered by Sorona

• The server backend in full: the REST API and the permission checks on it, the WebSocket layer, teams, channels and roles, file upload and attachment handling, search, and the compliance and export tooling

  Products and areas

  Covered by Sorona

• The webapp: message and markdown rendering, link previews and embeds, and the system console

  Products and areas

  Covered by Sorona

• Twelve first-party plugins, each listed by source repository: Calls, Playbooks, Boards, Copilot/AI, Jira, GitHub, GitLab, Zoom, MS Calendar, MS Teams, MS Teams Meetings and Confluence

  Products and areas

  Covered by Sorona

No target matches. Try part of a host name, such as the company name.