Ably

Bug bounty on Self-hosted ably.com

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

Top reward: $5,000 Critical: $5000
Lowest reward: $150 Low: $150
Response: Within 5 days We aim to acknowledge new reports within 5 working days.
Safe harbor: Full Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Hall of fame: Yes We really appreciate the work that our researchers do and love recognizing this on our acknowledgements page .

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

13 assets you may test, 5 excluded.

Out of scope (5)

What the policy asks of you, and the bug types it won't reward, quoted from Ably's policy. "We" in these lines means the program, not this site.

Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of service.
Only interact with accounts you own or with explicit permission of the account holder.
Targeted brute force attacks are NOT permitted to discover incorrect or missing rate limits such as checking the rate limit on a password input.
We ask that any details of a reported vulnerability remain confidential to best protect our users until the vulnerability is verified, fixed and retested.
Please provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third party.
Disclose the vulnerability report directly and exclusively to us.
Low-quality reports, such as those which only contain automated output, will be rejected. In addition, reports generated solely by AI are not acceptable.

Reports regarding username enumeration
Bugs requiring exceedingly unlikely user interaction
Reports of software usage disclosure or software version disclosure
Information disclosure about internal systems that does not represent a specific security vulnerability of confidentiality, integrity or availability
Reporting vulnerabilities that are deemed as accepted risks
Bugs that don't affect the latest version of modern browsers, or browser extensions
Attacks requiring MITM or physical access to a user's device
Previously known vulnerable libraries without a working proof of concept (PoC)
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
Sender Policy Framework (SPF), DKIM and DMARC configuration suggestions
Disclosure of known public files or directories (eg robots.txt)
Banner disclosure on common/public services without a PoC
Security header configurations or missing headers
Lack of Secure/HTTPOnly flags on non-sensitive cookies
Abstract possibility of phishing or social engineering attacks, including open redirects and CSRFs
Reports relating to TLS configuration or known protocol, ciphersuite or certificate weaknesses
Reports relating to applications that are non-customer facing

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake