Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

BeenVerified

Bug bounty on security.txt beenverified.com

Accepting reports Full safe harbor security.txt expired
Go to program Website
Top reward
Not published
Top severity paid
Not published
Assets in scope
4
Public CVEs
1
Last change
No changes yet

At a glance

What to know before you start testing.

Pays cash
Amounts are not published; ask before you invest time.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 3 days
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash
Yes Rewards are determined at BeenVerified’s sole discretion, based on the severity, impact, and quality of the report.
Response
Within 3 days We aim to acknowledge receipt of your report within 3 business days.
Safe harbor
Full We will not pursue legal action against individuals who: Report vulnerabilities in good faith; Follow this policy and conduct their testing responsibly; and Avoid privacy violations, service disruptions, and destruction of data.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

4 assets you may test, 2 excluded.

Domains 1

  • beenverified.com

Products and areas 3

  • All public-facing systems and services operated by BeenVerified
  • Any related assets that could reasonably be impacted by a vulnerability
  • Web and mobile applications under BeenVerified’s control
Out of scope (2)
  • services not owned or operated by BeenVerified or its direct partners
  • third-party services or software not under BeenVerified’s control

Rules

What the policy asks of you, and the bug types it won't reward, quoted from BeenVerified's policy.

While testing

  • No Denial of Service (DoS) Testing: Do not conduct any form of Denial of Service attack or actions that might cause service outages or degradation.
  • No Physical or Social Engineering: Physical or social engineering attacks (e.g., phishing, pretexting) are strictly prohibited.
  • No Testing of Third-party Services: Testing should not extend to services not owned or operated by BeenVerified or its direct partners.
  • No Uploading of Vulnerability or Client Data: Vulnerability details or any client-related content must not be uploaded to third-party platforms (e.g., GitHub, Dropbox, YouTube).
  • Limit Access and Reporting: If access to systems, accounts, users, or user data is gained, immediately cease further exploration at the point of recognition and report it.
  • Confidentiality of Vulnerabilities: All vulnerabilities submitted through this program are confidential and should not be discussed or disclosed without approval from all involved parties.
  • No Use of Automatic Scanners: Please do not use automatic scanners for vulnerability discovery.
  • Human Oversight Required: All AI-assisted findings must be thoroughly reviewed and validated by a human researcher before submission.

Not accepted

  • Issues without demonstrable security impact (e.g., missing security headers, descriptive error messages, clickjacking on non-authenticated pages)
  • Rate limiting or brute force attacks on non-sensitive endpoints
  • Spam or social engineering techniques
  • Vulnerabilities in third-party services or software not under BeenVerified’s control
  • Self-XSS (where the attacker must execute JavaScript in their own browser)
  • Reports from automated scanning tools without manual verification
  • Issues that require physical access to a device or facility
  • Reports of outdated software versions without an actual exploit
  • Theoretical vulnerabilities or best-practice recommendations without a clear security risk

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2014-5584 Medium 5.4 9 Sep 2014