Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

CoderPad

Bug bounty on Self-hosted coderpad.io

Accepting reports
Go to program Website
Top reward
$500
Top severity paid
Critical
Assets in scope
8
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $500
for critical bugs, from $50.
Report by email
[email protected]
Paid by voucher, virtual debit card (Visa), virtual gift cards, Paypal
No identity requirement stated.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $500
High $250
Medium $100
Low $50
Top reward
$500 Critical │ 500 USD
Lowest reward
$50 Low │ 50 USD
Hall of fame
Yes Here is a list of contributors to our responsible security disclosure program that accepted to be given credit :

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

8 assets you may test, 4 excluded.

Domains 7

  • accepted targets are coderpad.io and all its existing subdomains, with the exception of trustcenter.coderpad.io, status.coderpad.io and metabase related subdomains
  • coderpad.io
  • codingame-app.com
  • codingame.com
  • codingame.eu
  • status.coderpad.io
  • trustcenter.coderpad.io

Wildcard domains 1

  • all their existing subdomains
Out of scope (4)
  • metabase.codingame.com
  • status.coderpad.io
  • trustcenter.coderpad.io
  • metabase related subdomains such as metabase.codingame.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from CoderPad's policy. "We" in these lines means the program, not this site.

While testing

  • Spamming the sales or other forms is out of bounds of this program. Abuse will lead to being banned from the program.
  • Split each finding in a dedicated report. 1 Finding = 1 message = 1 ticket.
  • Avoid privacy violations, destruction or modification of data, and any interruption or degradation of our services.
  • Don’t interact with our end-users or their own customers and candidates.
  • No DoS / Bruteforce attacks : use of automated scans or testing is tolerated only if done at the pace of a real human user.
  • No social engineering, nor physical interaction with our users or employees, nor their equipment.
  • Limit the number of accounts you create to the required minimum for the PoC.
  • Allow a reasonable time (up to 90 days) for us to reproduce the issue, and fix it before making any information public.
  • Ask for our approval before making any disclosures.

Not accepted

  • Bugs not related to a security issue (non-200 HTTP response codes, 200 response code when an error triggers, application or server errors, and similar)
  • business logic (only) is not considered a security issue
  • All RATE LIMITING related reports , or missing throttling as well as theoretical brute-force
  • non-exploitable Self-XSS
  • logged-out CSRF
  • Missing HTTP security headers / cookie flags / CORS / ClickJacking / Mixed content / HSTS SSL/TLS configuration issues
  • Password policy
  • Server-side request forgery (SSRF) not leading to information leak, Cross-site Request Forgery (CSRF) with no or low impact.
  • Findings allowing spamming via email
  • Temporary Debug modes.
  • Origin IP disclosure .
  • Server information disclosure (component name / version).
  • Disclosed API keys without proven impact, Public API keys / customer ID for 3rd party tools etc…
  • E-mail configuration (SPF / DKIM / DMARC).
  • DNS configuration : lack of DNSSEC, lack of DNS CAA, DNS records leading to removed or non-existent resources.
  • Open ports without a demonstrated vulnerability.
  • Metadata in images.
  • Email validation issues without proven impact.
  • Enabled autocomplete attribute on web forms.
  • Improper cache-control directives. Including related to browser ‘back” function.
  • Text injection that is obviously abnormal/fraudulent to user.
  • Manipulation client-side faking vulnerabilities that are not real server-side.
  • Data injection from clients to analytics tools
  • All oAuth related findings (subsequent account deletion, oAuth refresh token validity, etc.)
  • File Upload feature allowing arbitrary file upload / download

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.