Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Status bug bounty programs

status.app Updated

Status runs one public program: a HackenProof bug bounty paying up to $5,000.

Top reward
$5,000
HackenProof
Programs
1
1 pays cash
Targets in scope
7
5 types
Last change
12 Nov 2026
1 hour ago

Where to report

The one public program Status runs.

  • Status

    HackenProof · Bug bounty

    Open

    Top reward

    $5,000
    Critical
    $5,000
    High
    –
    Medium
    –
    Low
    –

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

7 targets. 4 excluded.

  • *.status.app

    Wildcards No bounty

  • *.status.im

    Wildcards No bounty

  • status.app/api/download/linux

    Domains No bounty

  • status.app/api/download/windows

    Domains No bounty

  • https://status-im-files.ams3.cdn.digitaloceanspaces.com/StatusIm-Mobile-v1.19.0-d6a6c4.apk

    Android No bounty

  • https://apps.apple.com/us/app/status-private-communication/id1178893006

    iOS No bounty

  • Status Smart Contracts

    Smart contracts No bounty

No target matches. Try part of a host name, such as the company name.

Out of scope 4

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • dev.*.status.im

  • *.staging.status.im

  • test.*.status.im

  • discuss.status.im

Recent changes

Reward and scope changes across every Status program, newest first.

  • Back

    Open for reports again.

  • Paused

    Paused. Not accepting reports right now.

All changes · RSS feed

Recent CVEs

Published vulnerabilities in Status products, from the NVD.

Search NVD
  • CVE-2023-25780 Medium

    It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence.

  • CVE-2010-4658 Medium

    statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.

  • CVE-2010-4659 Medium

    Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.

  • CVE-2010-4660 Critical

    Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..

  • CVE-2011-3370 Medium

    statusnet before 0.9.9 has XSS

  • CVE-2019-12164 Critical

    ubuntu-server.js in Status React Native Desktop before v0.57.8_mobile_ui allows Remote Code Execution.

  • CVE-2013-4137 High

    Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow remote attackers to execute arbitrary SQL commands via vectors related to user lists and "a particular tag format."

  • CVE-2011-3802 Medium

    StatusNet 0.9.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tpl/index.php and certain other files.

About this page

This page gathers every public program listed under status.app: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.