- Top reward
- $300
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 1
- Last change
At a glance
What to know before you start testing.
- Pays up to $300
- top reward, from $250.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
very high risk vulnerability, 250 EUR
- Safe harbor
-
Partial
Participants agree not to disclose a vulnerability until it has been fixed, and to coordinate any disclosure with our team.
- Hall of fame
-
Yes
Kushal Arvind Shah of Fortinet's FortiGuard Labs - May 14, 2018 - for Eddie Windows installer - Vulnerability disclosure - NSIS bug 1125
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Reward range in US dollars. Self-hosted's own page has the details.
Scope
6 assets you may test.
Domains 3
- airvpn.org
- eddie.website
- ipleak.net
Source code 2
- https://github.com/AirVPN/Eddie
- https://gitlab.com/AirVPN
Products and areas 1
- The AirVPN applications for Windows, macOS, GNU/Linux and Android
Rules
What the policy asks of you, and the bug types it won't reward, quoted from AirVPN's policy. "We" in these lines means the program, not this site.
While testing
-
please report every vulnerability to [email protected]
-
Participants agree not to disclose a vulnerability until it has been fixed, and to coordinate any disclosure with our team.
-
Before transmitting any information about a vulnerability, please send us your GnuPG public key and use ours, published below, so that the whole communication remains confidential.
-
do not crack user accounts, corrupt databases or leak data that may be sensitive.
-
Testing that degrades the quality of service for our users is not allowed.
-
If in doubt, please contact our Security Team at [email protected] before testing.
-
by participating in this program, you agree to the rules and conditions on this page.
-
A report is eligible for a bounty only if all of them have been followed.
Not accepted
-
Flaws that affect only out-of-date browsers
-
Security issues outside the AirVPN threat model or service scope
-
Phishing or social engineering attacks
-
Bugs that require exceedingly unlikely user interaction
-
Out-of-date software
-
Software bugs in OpenVPN
-
Reports from automated scanners without a demonstrated impact
-
Missing security headers and Content Security Policy hardening
-
Version or banner disclosure
-
User name or e-mail address enumeration
-
Vulnerable third-party libraries without a working exploit against our services
-
Credentials stolen from users' devices, for example infostealer logs
-
SPF, DKIM and DMARC configuration
-
Rate limiting
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− https://nstaff1.airvpn.org/external_link?url=https%3A%2F%2Fgithub.com%2FAirVPN%2..., − https://github.com/AirVPN/Eddie
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2025-14979 | AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6. | High 8.5 | 6 Jan 2026 |