Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

4chan

By 4chan community support LLC Vulnerability disclosure program on Self-hosted 4chan.org

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
4
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
No safe harbor
No promise about legal action.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No We do not currently offer a cash reward.
Hall of fame
Yes Recognition on our Thanks page .

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

4 assets you may test, 6 excluded.

Domains 2

  • 4cdn.org
  • 4chan.org

Wildcard domains 2

  • *.4cdn.org
  • *.4chan.org
Out of scope (6)
  • 4chan users
  • CloudFlare
  • customers (4chan Pass users, advertisers, etc)
  • employees
  • nginx
  • volunteers (janitors, moderators, etc)

Rules

What the policy asks of you, and the bug types it won't reward, quoted from 4chan's policy. "We" in these lines means the program, not this site.

While testing

  • make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service during your research.
  • You must immediately report any vulnerability that allows access to personally identifiable information (PII), not copy or disseminate any PII obtained, and destroy any and all PII in your possession.
  • Please consolidate similar vulnerabilities across multiple files/domains into one report.
  • If your vulnerability allows you to compromise one of these accounts, please report it to us immediately and do not press further without written permission.

Not accepted

  • Vulnerabilities that rely on social engineering to be exploitable.
  • Physical attacks against 4chan users, volunteers, customers, employees, offices, and data centers.
  • Social engineering of 4chan users, volunteers, customers, employees, or service providers.
  • Knowingly posting, transmitting, uploading, linking to, or sending any malware.
  • Pursuing vulnerabilities which send unsolicited bulk or unauthorized messages (spam), and/or denial of service (DoS) attacks.
  • Any vulnerability obtained through the compromise of a 4chan user, volunteer, customer, or employee account.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope

    − Websites and services operated by 4chan, which include

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.