Rocket.Chat bug bounty programs
rocket.chat Updated
Rocket.Chat runs three public programs: a Sorona bug bounty paying up to $1,500, a self-hosted disclosure program with no cash rewards and a HackerOne disclosure program with no cash rewards (paused).
- Top reward
- $1,500
- Sorona
- Programs
- 3
- 1 pays cash
- Targets in scope
- 20
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Rocket.Chat
Sorona · Pays the most of the 3 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Rocket.Chat
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
Rocket.Chat
Self-hosted · Disclosure only |
– | – | – | – | No cash | None | – | – | Open |
|
Rocket.Chat
HackerOne · Disclosure only |
– | – | – | – | No cash | – | – | 5 days average | Paused |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
-
- Safe harbor
- None
-
- First response
- 5 days average
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
20 targets across all 3 programs, each listed once with the programs that cover it. 6 excluded.
-
Authentication in full: local accounts, OAuth and OpenID Connect providers, SAML, LDAP, CAS, two-factor and the login rate limiting in front of all of them
Products and areas
Covered by Sorona
-
Channel, private group, discussion and team permission evaluation, including membership, mentions, search, read receipts and anything that surfaces content from a room the caller has not joined
Products and areas
Covered by Sorona
-
Email flows, invitations and the registration and password reset paths
Products and areas
Covered by Sorona
-
File upload, storage and the access checks on retrieval, across every configured storage backend
Products and areas
Covered by Sorona
-
Livechat and the omnichannel surface, which is exposed to the public internet by design and shares the server with everything else
Products and areas
Covered by Sorona
-
Message rendering: markdown, embeds, code blocks, custom emoji and the link preview fetcher that reaches out on a user's behalf
Products and areas
Covered by Sorona
-
Push notification handling and what leaves the server for a third-party gateway
Products and areas
Covered by Sorona
-
The apps engine and the marketplace, incoming and outgoing integrations, and the scripts an integration is allowed to run
Products and areas
Covered by Sorona
-
The OAuth server Rocket.Chat can itself act as for other applications
Products and areas
Covered by Sorona
-
The responsible disclosure policy accepts reports through the HackerOne vulnerability disclosure programme or at [email protected] and recognises reporters in a Hall of Fame. It declares no boundary narrower than the product
Products and areas
Covered by Sorona
-
The REST API and the Meteor method surface behind the UI, which is the larger of the two and reachable directly over the websocket
Products and areas
Covered by Sorona
-
The roles and permissions model, the admin panel and every setting an administrator can change on a running server
Products and areas
Covered by Sorona
-
The server surface the mobile and desktop clients depend on, including the CDN and asset paths
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
A channel or team an administrator deliberately made public, or a permission they deliberately granted
Sorona
-
Findings against an unsupported release, since fixes land on the supported minor versions
Sorona
-
MongoDB and the rest of the deployment stack underneath the application
Sorona
-
Rocket.Chat Cloud infrastructure, which is a hosted service and a separate asset
Sorona
-
The mobile app store distribution and device-level attacks
Sorona
-
Third-party apps from the marketplace that the project does not maintain
Sorona
Recent changes
Reward and scope changes across every Rocket.Chat program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Rocket.Chat products, from the NVD.
-
CVE-2021-29935 High
An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
-
CVE-2021-29935 High
An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
-
CVE-2020-35882 High
An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.
-
CVE-2020-35882 High
An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.
About this page
This page gathers every public program listed under rocket.chat: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.