Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Decred

Bug bounty on Self-hosted decred.org

Accepting reports No KYC
Go to program Website
Top reward
$30,000
Top severity paid
Critical
Assets in scope
14
Public CVEs
1
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $30,000
for critical bugs, from $500.
Report by email
https://bounty.decred.org/
Partial safe harbor
Some legal protection; read the terms.
Paid by DCR
No identity check to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $30,000
High $15,000
Medium $5,000
Low $1,500
Top reward
$30,000 Critical: up to 30,000 USD
Lowest reward
$500 Note: up to 500 USD
Safe harbor
Partial Hazardous testing without explicit authorization will lead to disqualification.
Hall of fame
Yes Hall of Fame

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

14 assets you may test, 4 excluded.

Source code 13

  • cspp
  • dcrd
  • dcrlnd
  • dcrwallet
  • dcrwebapi
  • decrediton
  • https://github.com/decred/cspp
  • https://github.com/decred/dcrd
  • https://github.com/decred/dcrwallet
  • https://github.com/decred/dcrwebapi
  • https://github.com/decred/decrediton
  • https://github.com/decred/vspd
  • vspd

Domains 1

  • decred.org
Out of scope (4)
  • Bison Wallet (aka dcrdex)
  • dcrtime
  • Private RPCs which by default listen on localhost only
  • https://github.com/decred/dcrtime

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Decred's policy. "We" in these lines means the program, not this site.

While testing

  • All vulnerability reports need to have clear reproduction steps and/or proof of concept.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • Any type of public disclosure of the vulnerability without prior approval from the bug bounty program will make it ineligible for payout.
  • Please inform us if you have your own timeline for full disclosure (90 days minimum).
  • All current/past (for up to 6 months) Decred contractors are barred from participating.
  • You must not leverage the existence of a vulnerability or access to sensitive or confidential data to make threats, extortionate demands, or ransom requests.
  • Hazardous testing without explicit authorization will lead to disqualification.
  • Any vulnerability which is exploited on mainnet will immediately become ineligible for payout.
  • Content generated by LLMs must be meaningfully edited, validated, or supported by original analysis.
  • To submit a report, bug reporters must now make a $5 USD deposit in DCR.

Not accepted

  • Bugs which do not lead to security vulnerabilities.
  • Misconfiguration or vulnerabilities in chat and communication platforms including email, Element/Matrix, Discord, and the Decred forum.
  • Vulnerabilities in old releases, proof-of-concept code, feature branches, or projects still under development.
  • Duplicate reports or reports of vulnerabilities which are already known (note that some of our issue tracking is private).
  • Vulnerabilities which only exist on testing or staging sites.
  • Broken link hijacking.
  • Tabnabbing.
  • Content spoofing and text injection issues.
  • Self-exploitation, such as self-XSS or self-DoS (unless it can be used to attack a different account).
  • Clickjacking on pages with no sensitive actions.
  • Cross-Site Request Forgery (CSRF) on forms with no sensitive actions (e.g. Logout).
  • Permissive CORS configurations without demonstrated security impact.
  • Software version disclosure/banner identification issues/descriptive error messages or headers (e.g. stack traces, application or server errors).
  • Comma Separated Values (CSV) injection.
  • Open redirects (unless you can demonstrate additional security impact).
  • Outdated software/library versions.
  • SSL/TLS Configurations.
  • Lack of SSL Pinning.
  • Insecure settings in non-sensitive cookies (e.g. missing HttpOnly/Secure flags).
  • Content-Security-Policy configuration opinions.
  • DMARC, SPF, or other email server or DNS configuration settings and policies.
  • Most issues related to rate limiting.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2018-17145 High 7.5 10 Sep 2020