Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Coinpayments

By CoinPayments, Inc. Bug bounty on Self-hosted coinpayments.net

Accepting reports Full safe harbor
Go to program Website
Top reward
$1,000
Top severity paid
Critical
Assets in scope
12
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $1,000
for critical bugs, from $50.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Paid by BTC
No identity requirement stated.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $1,000
High $500
Medium $250
Low $100
Top reward
$1,000 Critical priority ($1000+)
Lowest reward
$50 Very low priority ($50+)
Safe harbor
Full We will not take any legal action if you play by the rules

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

12 assets you may test, 2 excluded.

Wildcard domains 8

  • *.coinpayment.net
  • *.coinpayment.net/*
  • *.coinpayments.com
  • *.coinpayments.com/*
  • *.coinpayments.net
  • *.coinpayments.net/*
  • *.gocps.net
  • *.gocps.net/*

Domains 4

  • coinpayment.net
  • coinpayments.com
  • coinpayments.net
  • gocps.net
Out of scope (2)
  • COINPAYMENTS mobile applications
  • The CoinPayments Mobile applications are not part of this bug bounty program.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Coinpayments's policy. "We" in these lines means the program, not this site.

While testing

  • Only the first person to report a vulnerability will be awarded
  • Reports have to follow our disclosure guidelines
  • Full details have to be shared about the problems found
  • Disruption of services, compromising/sharing of any user data or breaking the law is strictly forbidden
  • Attacks that can result in harm to the reliability of our service are forbidden. Attacks that can result in data integrity issues are also forbidden. (D)DoS, spam attacks et cetera are strictly forbidden.
  • Don't use automated tools to search for vulnerabilities. Your CoinPayments account can get suspended as a result.
  • Attacks involving social engineering, phishing, et cetera of CoinPayments staff and users are strictly forbidden.
  • Do not perform any attacks that are in violation of the law.
  • A report shall have detailed steps to reproduce the issue, including links you visited, screenshots or screencasts where needed.
  • A report shall include versions of software and all factors that played a role in the attack (browser, OS, et cetera.)

Not accepted

  • Issues that pertain to anything forbidden in the program rules
  • Reports generated by automated tools
  • Software issues that are made public
  • Reports that do not include testing or context specific to CoinPayments
  • Issues that require you to already have access to a victim's account, physical device, and/or registered email account.
  • Denial of Service attacks
  • Brute Force attacks
  • Spam techniques (DKIM / SPF et cetera)
  • Social Engineering issues
  • Content injection/spoofing
  • Path disclosure
  • Version information disclosure
  • Issues that we are already aware of
  • Disclosure of trivial, non-sensitive public information
  • Vulnerabilities in our official plugins that are specific to the shopping cart system, rather than our plugin
  • Issues regarding spoofed e-mails
  • HTTP Security Headers related issues without a proof of concept leveraging the issue
  • Issues regarding SSL/TLS cipher suites without a proof of concept leveraging the issue
  • Issues that can't be reproduced in the latest major browser versions (Edge, Firefox, Chrome, Safari)
  • Issues leveraging the presence of browser extensions

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 6 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.