Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Alaan

Bug bounty on Self-hosted alaan.com

Accepting reports KYC to get paid
Go to program Website
Top reward
$1,500
Top severity paid
Not published
Assets in scope
10
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $1,500
top reward, from $100.
Report by email
[email protected]
Partial safe harbor
Some legal protection; read the terms.
Payment
Proof of identity needed to get paid.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Top reward
$1,500 1000 - 1500
Lowest reward
$100 100 - 200
Safe harbor
Partial All attempts to cause harm to Alaan’s systems and data that do not follow responsible disclosure will be pursued legally to the full extent permitted by law.
Hall of fame
Yes Entry in the Hall of Fame for accepted reports (if preferred)

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

10 assets you may test, 2 excluded.

Domains 5

  • alaanpay.com
  • alaan web application
  • apps.apple.com
  • play.google.com
  • www.alaan.com

Android apps 2

  • Alaan Android
  • https://play.google.com/store/search?c=apps&q=alaan

iOS apps 2

  • Alaan iOS
  • https://apps.apple.com/in/app/alaan/id1605833078

Web 1

  • https://app.alaanpay.com
Out of scope (2)
  • All external services/software not managed or controlled by Alaan
  • All sandbox, staging and lower environments

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Alaan's policy. "We" in these lines means the program, not this site.

While testing

  • Do not run any automated scans against Alaan targets.
  • Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
  • Ask the Alaan team before submitting vulnerabilities on unscoped subdomains
  • Only interact with accounts you own or with the explicit permission of the account holder.
  • We expect that you will give us reasonable lead time to respond to your report before making any information public
  • make a good-faith effort to avoid privacy violations, data destruction, and interruptions or degradations of our services during your research.

Not accepted

  • Security issues in third-party apps or websites that integrate with Alaan
  • Descriptive error messages (e.g., Stack Traces, application or server errors).
  • HTTP codes/pages or other HTTP non-codes/pages.
  • Fingerprinting/banner disclosure on common/public services.
  • Disclosure of known public files or directories (e.g., robots.txt).
  • Clickjacking and issues that are only exploitable through social engineering.
  • CSRF in forms that are available to anonymous users (e.g., the contact form).
  • Logout Cross-Site Request Forgery (logout CSRF).
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
  • Lack of Security Speedbump when leaving the site.
  • Weak Captcha / Captcha Bypass
  • OPTIONS HTTP method enabled
  • HTTPS Mixed Content Scripts
  • Self-XSS
  • Username/email enumeration
  • Missing HTTP security headers
  • SSL Issues
  • Spamming (e.g., SMS/Email Bombing)
  • MITM attacks (traffic interception-based attacks called out as out of scope)
  • Vulnerabilities requiring installation of software on the victim's device
  • (Distributed) Denial of Service attacks
  • Any language, grammar, technical inaccuracy, or UI/UX issues
  • Expired domains, SSL/TLS certificates, or leakage via Certificate Transparency Logs
  • Unclaimed social media accounts
  • Reports of keys/tokens in JS without proof of exploitability

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 6 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope

    − Alaan Android, − Alaan iOS, − Mobile Apps

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.