- Top reward
- $2,100
- Top severity paid
- Critical
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $2,100
- for critical bugs, from $100.
- Report on Bugcrowd
- Submit through the program page.
- No public write-ups
- Keep findings private.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$2,100 from $1,500 |
| High |
|
$1,000 from $800 |
| Medium |
|
$500 from $300 |
| Low |
|
$150 from $100 |
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $2,100
Scope
3 assets you may test, 4 excluded.
Web 3
- ████████████████████
- ██████████████████████████
- █████████████████████████████
Out of scope (4)
- █████████████████████████
- ██████████████████████████████
- ███████████████████████████████
- █████████████████████████████████████
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Council on Foreign Relations (via Bugcrowd)'s policy.
While testing
-
You MUST use your @bugcrowdninja.com email address for any accounts related to testing on this program.
-
Please limit automated scanners to 2 requests per second or less.
-
Use "bugcrowd" as the first name on all account creation
Not accepted
-
Any attempt at DOS / DDOS attacks.
-
Subdomain takeovers
-
Rate limiting submissions
-
Twitter handles/link hijacks
Summarised with AI from the program policy on Bugcrowd, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Company Overview The Council on Foreign Relations invites you to test their websites https://cfr.org and https://foreignaffairs.com ! About CFR - The Council on Foreign Relations (CFR) is an independent, nonpartisan membership organization, think tank, and publisher dedicated to being a resource for its members, government officials, business executives, journalists, educators and students, civic and religious leaders, and other interested citizens in order to help them better understand the world and the foreign policy choices facing the United States and other countries. Founded in 1921, CFR takes no institutional positions on matters of policy. This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization/rating of findings.
Targets
Any domain or property of Council on Foreign Relations not listed in the targets section is out of scope. This includes any and all subdomains not listed above. About Targets Center on Foreign Relations is an organization for international affairs and news. We're hoping researchers will help our team test the website to allow our users to operate in a safe environment. Throughout this test, please keep in mind that there are pages which are operated by 3rd-party providers like Drupal, TCS, etc. and are not included in the scope of the program. Refer to the Out-of-Scope domains (listed above) and the Out-of-Scope section (below). Credentials You can create an account for yourself at foreignaffairs.com and modeldiplomacy only (CFR.org user accounts are Out-of-Scope). You MUST use your @bugcrowdninja.com email address for any accounts related to testing on this program. To create an account, please follow this flow: Foreign Affairs - "Sign-in" > "Register" > register with your BCninja email address Model Diplomacy - Use "bugcrowd" as the first name on all account creation (you can make both student and instructor accounts) NOTE: User account functionality on CFR.com is Out-of-Scope. Out-of-Scope Any attempt at DOS / DDOS attacks. Please limit automated scanners to 2 requests per second or less. Any functionality, pages, or communications hosted by or operated by a 3rd party. Account functionality located at cfr.org Subdomain takeovers Rate limiting submissions https://subscribe.foreignaffairs.com https://subs.foreignaffairs.com World101.cfr.org modeldiplomacy.cfr.org Twitter handles/link hijacks