- Top reward
- $20,000
- Top severity paid
- Critical
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $20,000
- for critical bugs, from $100.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$20,000 from $5,000 |
| High |
|
$5,000 from $1,000 |
| Medium |
|
$1,000 from $500 |
| Low |
|
$500 from $100 |
- Top reward
-
$20,000
Critical Severity: $5,000 - $20,000
- Lowest reward
-
$100
Low Severity: $100 - $500
- Response
-
Within 3 days
Acknowledge your submission within three (3) business days; and
- Safe harbor
-
Full
When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state or national laws);
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 10 excluded.
Domains 1
- coderabbit.ai
Wildcard domains 1
- coderabbit domain and related subdomains
Products and areas 1
- all internet-facing information systems, applications, or websites owned, operated, or controlled by us
Out of scope (10)
- Clickjacking on pages with no sensitive actions
- Compromises involving an insider
- Denial-of-service attacks
- Dependency hijacking
- Missing HttpOnly or Secure flags on cookies
- Physical compromise or intrusion
- Rate limiting or brute-force issues on unauthenticated endpoints
- Red-teaming and adversarial testing of the services
- Reflected file downloads
- Social engineering, including phishing attempts
Rules
What the policy asks of you, and the bug types it won't reward, quoted from CodeRabbit's policy. "We" in these lines means the program, not this site.
While testing
-
Use low-value transactions only. Testing involving financial payments must not exceed $200 USD.
-
Avoid accessing or modifying user data
-
Do not publicly disclose the issue until we've had a chance to address it
-
Only interact with accounts you own or with explicit permission of the account holder.
-
Not exploit a security issue you discover for any reason other than testing.
-
Report any vulnerability you've discovered promptly.
-
Avoid disclosing the existence of or any details relating to the discovered vulnerability to any third party or to the public until you have received prior written approval from us.
-
Not access, modify, or use data belonging to others, including confidential CodeRabbit data.
-
Not exfiltrate, download, or otherwise retain any data that you collect.
-
Disclosure of vulnerabilities to CodeRabbit must be unconditional.
Not accepted
-
general security, email best practices, or missing best practices in SSL/TLS configurations without a working proof-of-concept
-
physical compromise or intrusions
-
rate limiting or brute-force issues on non-authenticated endpoints
-
compromises involving an insider
-
social engineering (including phishing attempts)
-
reflected file downloads
-
account takeovers (including any brute-force attacks on accounts that are not yours)
-
red-teaming, adversarial testing of our services
-
content issues with CodeRabbit bot and responses
-
denial-of-service attacks
-
clickjacking on pages with no sensitive actions
-
missing HttpOnly or Secure flags on cookies
-
dependency hijacking
-
any widely publicized zero-day vulnerabilities that have no patch or have only had a patch available for less than 30 days
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.