Amp

Bug bounty on Self-hosted ampcode.com

Accepting reports Full safe harbor security.txt

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash: Yes Higher severity issues are eligible for cash bounties.
Safe harbor: Full Authorized under any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

8 assets you may test, 10 excluded.

Out of scope (10)

trust.ampcode.com
ampcode.com subdomains operated by third-parties, including trust.ampcode.com and auth.ampcode.com.
Assets not related to Amp, or not owned by Amp.
Automated scanner output without a working proof of concept.
Denial of service and other volumetric attacks.
Missing security headers, cookie flags, or SPF/DKIM/DMARC configuration without demonstrated impact.
Sample code, example projects, demos, and unsupported or archived projects are out of scope, including those published in Amp-owned GitHub repositories.
Self-XSS, and clickjacking on pages without sensitive actions.
Social engineering or phishing of Amp staff, and physical attacks.
Vulnerabilities in third-party dependencies without demonstrated impact on Amp.

What the policy asks of you, and the bug types it won't reward, quoted from Amp's policy. "We" in these lines means the program, not this site.

Report any vulnerability you’ve discovered promptly;
Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience;
Use only the Official Channels to discuss vulnerability information with us;
Provide us a reasonable amount of time (at least 90 days from the initial report) to resolve the issue before you disclose it publicly;
Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope;
Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept;
cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII) or proprietary information;
Interact only with test accounts you own or with explicit permission from the account holder; and
Do not engage in extortion

prompt injection and LLM security research
Automated scanner output without a working proof of concept.
Missing security headers, cookie flags, or SPF/DKIM/DMARC configuration without demonstrated impact.
Self-XSS, and clickjacking on pages without sensitive actions.
Denial of service and other volumetric attacks.
Social engineering or phishing of Amp staff, and physical attacks.
Vulnerabilities in third-party dependencies without demonstrated impact on Amp.
Reports of theoretical issues without a demonstrated impact do not qualify.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

No Expires field

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake