Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Chameleon

Bug bounty on Self-hosted trychameleon.com

Accepting reports
Go to program Website
Top reward
Not published
Top severity paid
Not published
Assets in scope
1
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays cash
Amounts are not published; ask before you invest time.
Report by email
[email protected]
Partial safe harbor
Some legal protection; read the terms.
Replies within 3 days
As the policy promises.
Paid by PayPal
No identity requirement stated.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash
Yes We pay bounties to unique (unreported) disclosures. The amount varies due to how severe the issue has been determined to be. If a bounty is rewarded, it will be paid out through Paypal .
Response
Within 3 days Someone from our security team will be in contact with you via email, in the next few days to confirm that we have received your report.
Safe harbor
Partial To encourage responsible reporting, we will not take legal action against you provided that you comply with the following Responsible Disclosure Guidelines and other rules of this program:

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

1 asset you may test.

Domains 1

  • chameleon.io

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Chameleon's policy. "We" in these lines means the program, not this site.

While testing

  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
  • Do not modify or access data that does not belong to you.
  • In cases where potential data modification is possible, contact: [email protected] and we will work with you to reproduce the vulnerability in a safe environment.

Not accepted

  • Broad security concepts without specific information pertaining to Chameleon or our platform
  • Open redirects (through headers and parameters) / Lack of security speedbump when leaving the site
  • Internal IP address disclosure
  • Accessible Non-sensitive files and directories (e.g. README.TXT, CHANGES.TXT, robots.txt, .gitignore, etc)
  • Social engineering or phishing attacks
  • Self XSS
  • Text injection
  • Email spoofing (including SPF, DKIM, DMARC)
  • Fingerprinting/banner disclosure on common or public services
  • Clickjacking and issues only exploitable through clickjacking
  • CSRF issues that don't impact the integrity of an account (e.g. log in or out, contact forms and other publicly accessible forms)
  • Lack of rate limiting or other missing DOS protections
  • HTTPS mixed content scripts
  • Missing HTTP security headers
  • Denial of Service attacks
  • Lack of MFA
  • Use of a known-vulnerable component (exceptional cases, such as where you are able to provide proof of exploitation, may still be in scope)

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.