Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Amplify

Bug bounty on security.txt amplify.com

Accepting reports Full safe harbor security.txt
Go to program Website
Top reward
Not published
Top severity paid
Not published
Assets in scope
2
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays cash
Amounts are not published; ask before you invest time.
Report by email
https://amplify.com/report-a-vulnerability
Full safe harbor
Good-faith research is authorised; no legal action.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash
Yes In order to receive an award for validated reports, you must have a HackerOne account.
Safe harbor
Full We will not take legal action against you if vulnerabilities are found and responsibly reported in compliance with all of the terms and conditions outlined in this policy.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

2 assets you may test, 3 excluded.

Domains 1

  • amplify.com

Products and areas 1

  • any Amplify-owned asset
Out of scope (3)
  • amplifyprototypes.com
  • our offices or data centers
  • third party services or providers not under Amplify’s control

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Amplify's policy. "We" in these lines means the program, not this site.

While testing

  • Only interact with test accounts that you created via self sign-up or were provided by Amplify.
  • The use of any credentials outside of these areas for testing purposes, including legacy leaked credentials from third parties, is strictly prohibited.
  • Do not contact Amplify’s customer support for questions or to submit a vulnerability report.
  • Any testing conducted on customer data or accounts is strictly prohibited and will result in removal from the program.
  • DO NOT include any text, screenshots, etc. with PII in the report.
  • Do not access, download, or share any data you encounter in your testing.
  • Both Proof of Concept (POC) videos and written reproduction steps are required for all submissions.
  • Multiple reports describing the same vulnerability against multiple assets or endpoints must be submitted within a single report.
  • Automated scanning tests should be kept to 10 requests per second or less.

Not accepted

  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • Clickjacking on pages with no sensitive actions.
  • Unauthenticated/logout/login CSRF.
  • Attacks requiring MITM or physical access to a user’s device.
  • Previously known vulnerable libraries without a working Proof of Concept.
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability.
  • Missing best practices in SSL/TLS configuration.
  • Any activity that could lead to the disruption of our service (DoS).
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
  • XSRF that requires the knowledge of a secret.
  • Automated tools that could generate significant traffic and possibly impair the functioning of our services.
  • Testing or demonstrating the ability to upload unlimited audio/video files to exhaust resources.
  • Leaked credentials from third party providers, including invalid or stale employee credential dumps, and/or leaked personal information of Amplify staff.
  • Leaked credentials for Amplify customers not caused by vulnerabilities in our systems.
  • Vulnerabilities identified via third party services or providers where Amplify is not the owner.
  • Issues that merely result in spam/annoyance without additional impact (e.g sending emails without sufficient rate limiting)
  • Attempts to access our offices or data centers.
  • Self XSS.
  • Broken links and/or crashes in general.
  • Issues that require unlikely user interaction.
  • Issues that do not affect the latest version of modern browsers
  • Issues that require physical access to a victim’s computer/device.
  • Disclosure of information that does not present a significant risk

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.