Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

CoderPad and CodinGame

Bug bounty on Self-hosted codingame.com

Accepting reports
Go to program Website
Top reward
$500
Top severity paid
Critical
Assets in scope
6
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $500
for critical bugs, from $50.
Report as the policy says
The policy page explains how.
Paid by voucher, virtual debit card (Visa), virtual gift cards, Paypal
No identity requirement stated.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $500
High $250
Medium $100
Low $50
Top reward
$500 Critical │ 500 USD
Lowest reward
$50 Low │ 50 USD
Hall of fame
Yes Here is a list of contributors to our responsible security disclosure program that accepted to be given credit :

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

6 assets you may test, 3 excluded.

Domains 5

  • coderpad.io
  • codingame-app.com
  • codingame.com
  • codingame.eu
  • metabase.codingame.com

Wildcard domains 1

  • all their existing subdomains
Out of scope (3)
  • status.coderpad.io
  • trustcenter.coderpad.io
  • metabase related subdomains such as metabase.codingame.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from CoderPad and CodinGame's policy. "We" in these lines means the program, not this site.

While testing

  • Spamming the sales or other forms is out of bounds of this program. Abuse will lead to being banned from the program.
  • Split each finding in a dedicated report. 1 Finding = 1 message = 1 ticket. Reports containing more than 1 finding / mixing too different findings will be rejected.
  • Check your findings, disclosing client side javascript code, public API key, or reporting things obviously in the “none” category below is a waste of time for you and us.
  • Avoid privacy violations, destruction or modification of data, and any interruption or degradation of our services.
  • In the case that you acquire private data despite the previous rule, please dispose of it as soon as possible (ie when not required anymore for PoC).
  • Don’t interact with our end-users or their own customers and candidates.
  • No DoS / Bruteforce attacks : use of automated scans or testing is tolerated only if done at the pace of a real human user.
  • No social engineering, nor physical interaction with our users or employees, nor their equipment.
  • Limit the number of accounts you create to the required minimum for the PoC. Creating more than a few accounts will not be tolerated.

Not accepted

  • All RATE LIMITING related reports , or missing throttling as well as theoretical brute-force, except if leading to proven exploitable vulnerability.
  • Issues without a clear security impact (except if obviously leading to a valid vulnerability as stated above) :
  • non-exploitable Self-XSS
  • logged-out CSRF
  • Missing HTTP security headers / cookie flags / CORS / ClickJacking / Mixed content / HSTS SSL/TLS configuration issues
  • Password policy
  • Server-side request forgery (SSRF) not leading to information leak, Cross-site Request Forgery (CSRF) with no or low impact.
  • Findings allowing spamming via email
  • Temporary Debug modes.
  • Origin IP disclosure .
  • 3rd Party tools disputed failures, for instance those that can be balanced by anti-DDOS or WAF (WordPress script loader, wp-cron, login csrf etc…).
  • Disclosed API keys without proven impact, Public API keys / customer ID for 3rd party tools etc…
  • E-mail configuration (SPF / DKIM / DMARC).
  • DNS configuration : lack of DNSSEC, lack of DNS CAA, DNS records leading to removed or non-existent resources.
  • Open ports without a demonstrated vulnerability.
  • Vulnerabilities only affecting users of outdated or unpatched browsers or software.
  • Systems being phased out except if leading to sensitive information leak
  • Username / email enumeration except if leading to easily exploitable credential leak.
  • Metadata in images.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.