arkadiyt-projects
Vulnerability disclosure program on HackerOne arkadiyt.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 8
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Public disclosure allowed
- You may publish your report.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
Please note that this program only offers thanks for bug submissions - it is a vulnerability disclosure program for my personal projects and source code.
- Safe harbor
-
Full
I will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
8 assets you may test.
Source code 7
- https://github.com/arkadiyt/aws_public_ips Critical No bounty
- https://github.com/arkadiyt/bounty-targets Critical No bounty
- https://github.com/arkadiyt/ddexport Critical No bounty
- https://github.com/arkadiyt/free-ft Critical No bounty
- https://github.com/arkadiyt/protodump Critical No bounty
- https://github.com/arkadiyt/ssrf_filter Critical No bounty
- https://github.com/arkadiyt/zoom-redirector Critical No bounty
Wildcard domains 1
- *.arkadiyt.com Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from arkadiyt-projects (via HackerOne)'s policy.
While testing
-
Include a PoC and complete steps to reproduce your report.
-
Reports must be practical and have demonstrable security implications, not just be a theoretical scenario or a missing best practice.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Please note that this program only offers thanks for bug submissions - it is a vulnerability disclosure program for my personal projects and source code.
Program Rules
Include a PoC and complete steps to reproduce your report. Reports must be practical and have demonstrable security implications, not just be a theoretical scenario or a missing best practice.
Disclosure Policy
After a report is resolved, you are welcome to disclose it, blog about it, etc.
Safe Harbor
I will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. I consider activities conducted consistent with this policy to constitute “authorized” conduct under the Computer Fraud and Abuse Act. I will not bring a DMCA claim against you for circumventing the technological measures I have used to protect the applications in scope.
If legal action is initiated by a third party against you and you have complied with this bug bounty policy, I will take steps to make it known that your actions were conducted in compliance with this policy.
Please understand that if your security research involves the networks, systems, information, applications, products, or services of another party (which is not me), that third party may determine whether to pursue legal action. I cannot and do not authorize security research in the name of other entities.
I will not share your report with a third-party without your permission and/or gaining their commitment they will not pursue legal action against you. Please note again that I can’t authorize out-of-scope testing in the name of third parties and such testing is beyond the scope of the program.
In order to encourage the adoption of bug bounty programs and promote uniform security best practices across the industry, I reserve no rights in this bug bounty policy and so you are free to copy and modify it for your own purposes.