Skip to content

Tenable bug bounty programs

tenable.com Updated

Tenable runs two public programs: a self-hosted disclosure program with no cash rewards and a HackerOne disclosure program with no cash rewards.

Top reward
No cash
Disclosure only
Programs
2
None pays cash
Targets in scope
20
3 types, deduplicated
Last change
None yet
Tracked since Nov 2026

Where to report

2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Tenable

Self-hosted · A disclosure program: you report for credit, not cash.

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

20 targets across all 2 programs, each listed once with the programs that cover it. 16 excluded.

  • tenable.com

    Domains

    Covered by Self-hosted

  • Tenable Enclave Security

    Desktop and binaries Critical No bounty

    Covered by HackerOne

  • Tenable Sensor Proxy

    Desktop and binaries Critical No bounty

    Covered by HackerOne

  • Nessus

    Products and areas Critical No bounty

    Covered by HackerOne

  • Nessus Agent

    Products and areas Critical No bounty

    Covered by HackerOne

  • Nessus Network Monitor

    Products and areas High No bounty

    Covered by HackerOne

  • Tenable Attack Surface Management

    Products and areas Critical No bounty

    Covered by HackerOne

  • Tenable Cloud Security

    Products and areas Critical No bounty

    Covered by HackerOne

  • Tenable Core

    Products and areas Critical No bounty

    Covered by HackerOne

  • Tenable Identity Exposure

    Products and areas Critical No bounty

    Covered by HackerOne

  • Tenable Log Correlation Engine

    Products and areas

    Covered by Self-hosted

  • Tenable Lumin

    Products and areas Critical No bounty

    Covered by HackerOne

  • Tenable Nessus

    Products and areas

    Covered by Self-hosted

  • Tenable Nessus Network Monitor

    Products and areas

    Covered by Self-hosted

  • Tenable One Exposure Management Platform

    Products and areas Critical No bounty

    Covered by HackerOne

  • Tenable OT Security

    Products and areas Critical No bounty

    Covered by HackerOne

  • Tenable Security Center

    Products and areas Critical

    Covered by Self-hosted, HackerOne

  • Tenable Vulnerability Management

    Products and areas Critical

    Covered by Self-hosted, HackerOne

  • Tenable Web Application Scanning

    Products and areas Critical No bounty

    Covered by HackerOne

  • Tenable web site

    Products and areas

    Covered by Self-hosted

No target matches. Try part of a host name, such as the company name.

Out of scope 16

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • careers.tenable.com

    HackerOne

  • cloud.tenable.com

    HackerOne

  • community.tenable.com

    HackerOne

  • de.tenable.com

    HackerOne

  • developers.tenable.com

    HackerOne

  • docs.tenable.com

    HackerOne

  • fr.tenable.com

    HackerOne

  • go.tenable.com

    HackerOne

  • http://events.tenable.com

    HackerOne

  • login.tenable.com

    HackerOne

  • partners.tenable.com

    HackerOne

  • static.tenable.com

    HackerOne

  • suggestions.tenable.com

    HackerOne

  • university.tenable.com

    HackerOne

  • www.tenable.com

    HackerOne

  • Terrascan

    HackerOne

Recent changes

Reward and scope changes across every Tenable program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under tenable.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.