Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Deribit

Bug bounty on HackerOne deribit.com

Accepting reports Full safe harbor
Go to program Website
Top reward
$50,000
Top severity paid
Critical
Assets in scope
8
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $50,000
for critical bugs.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $50,000 from $2,500
High $10,000 from $750
Medium $1,000 from $250
Low $300 from $50
Safe harbor
Full Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

8 assets you may test, 5 excluded.

Web 3

  • insights.deribit.com Medium
  • pb.deribit.com Medium
  • test.deribit.com Critical

Android apps 1

  • com.deribit Critical

iOS apps 1

  • 1293674041 Critical

Wildcard domains 1

  • *.deribit.com Medium

Products and areas 2

  • Tier 1 Critical
  • Tier 2 Critical
Out of scope (5)
  • deribit.zendesk.com
  • office.deribit.com
  • support.deribit.com
  • trust.deribit.com
  • *.chattest.deribit.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Deribit (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • ALL TESTS SHOULD BE PERFORMED ON OUR TEST ENVIRONMENT : TEST.DERIBIT.COM
  • Testing directly on www.deribit.com will make you ineligible for bounty and disallowed from further hunting.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Only interact with accounts you own or with explicit permission of the account holder.
  • Hackers are not allowed to discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Deribit.

Not accepted

  • Clickjacking on Tier 2 targets
  • SPF/DMARC misconfiguration
  • Social engineering of Deribit staff or contractor
  • Banner grabbing or low sensitive information disclosure
  • Any hypothetical flaw or best practices without exploitable POC
  • Any report generated by automatic tool without a POC
  • Missing security header
  • Missing best practice in SSL/TLS configuration
  • Vulnerability that require root/jailbreak to exploit
  • Password policy
  • No rate limiting or too lax
  • Wordpress CORS policy, xmlrpc, user enumeration, dos ...
  • Broken link
  • Attacks requiring MITM or physical access to a user's device
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
  • Missing HttpOnly or Secure flags on cookies
  • Customers credentials found on the darknet or other forums if they are not Deribit's fault
  • Employees API keys that are only working on our test environment (production's one are in scope)
  • Newly disclosed Zero Days (refer to Oudated components) and Zero Days

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

ATTENTION : ALL TESTS SHOULD BE PERFORMED ON OUR TEST ENVIRONMENT : TEST.DERIBIT.COM Testing directly on www.deribit.com will make you ineligible for bounty and disallowed from further hunting.

Introduction

Deribit is the leading cryptocurrency option exchange by volume and uses the latest available technology to offer microsecond response time. We value security and availability before all so that traders can focus fully on what matters the most to them, making money. As a part of our perpetual quest for improvement and security, we highly respect and value the work of ethical hackers. We take security very seriously and strive to provide lightning fast response times to our hunters. No technology is perfect and Deribit believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web & mobile apps. Deribit continuously pushes out new code. In the event you don’t find anything today, there may be something present tomorrow! We appreciate a timely response on our testnet changes. Good luck, and happy hunting!

Disclosure Policy

  • Hackers are not allowed to discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from Deribit.
  • Follow HackerOne's disclosure guidelines.

Program Rules

Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
  • Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Live environment

Testing is only allowed on our test environment. Our live environment (www.deribit.com) contains a few additional features, including KYC verification and cryptocurrency deposit/withdrawal. If you wish to hunt on this features, you first need to find a valid vulnerability on our test environment. Then, you may ask for authorization through your open ticket to hunt on our live environment. Please note that due to strict regulations, Deribit is not open to trading in certain countries

Oudated components

Deribit rewards reports on vulnerable software or dependencies if the following conditions are met:

  • A proof-of-concept (PoC) is provided demonstrating exploitability in our infrastructure ;
  • The affected component has not been updated within a reasonable timeframe.

We will begin accepting reports once the following timeframes have elapsed since the CVE was published:

Target Critical High Medium or Low
www.deribit.com / test.deribit.com 24 hours 7 days 14 days
*.deribit.com 7 days 14 days 30 days

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

  • The live trading systems are only in scope for wallet & balance functionality as the implementation is different on test
  • Ability to upgrade from an account:read_write api key to higher privilege is not considered a privilege escalation. This is intended purpose.
  • Zendesk
  • Newly disclosed Zero Days (refer to Oudated components) and Zero Days
  • Clickjacking on Tier 2 targets
  • SPF/DMARC misconfiguration
  • Deribit open source projects
  • Social engineering of Deribit staff or contractor
  • Banner grabbing or low sensitive information disclosure
  • Any hypothetical flaw or best practices without exploitable POC
  • Any report generated by automatic tool without a POC
  • Missing security header
  • Missing best practice in SSL/TLS configuration
  • Vulnerability that require root/jailbreak to exploit
  • Password policy
  • No rate limiting or too lax
  • Wordpress CORS policy, xmlrpc, user enumeration, dos ...
  • Broken link
  • Attacks requiring MITM or physical access to a user's device
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
  • Missing HttpOnly or Secure flags on cookies
  • Customers credentials found on the darknet or other forums if they are not Deribit's fault
  • Employees API keys that are only working on our test environment (production's one are in scope)

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under his policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Deribit and our users safe!