Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Devo

By Devo Technology, Inc. Bug bounty on Self-hosted devo.com

Accepting reports Full safe harbor
Go to program Website
Top reward
Not published
Top severity paid
Not published
Assets in scope
1
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays cash
Amounts are not published; ask before you invest time.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 30 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash
Yes After remediation, you may be eligible to receive a bounty payment, subject to the terms and conditions of the Responsible Disclosure Agreement.
Response
Within 30 days Upon receipt of the report, we will review and investigate the vulnerability as soon as practicable and no later than within 30 days from receipt of the report.
Safe harbor
Full Devo Technology, Inc. will not engage in legal action against individuals who, in good faith, submit vulnerability reports following these guidelines and procedures.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

1 asset you may test, 11 excluded.

Products and areas 1

  • data analytics and SIEM software solutions that we develop and license to our customers
Out of scope (11)
  • Attacks involving stolen credentials or physical access to endpoint devices
  • Automated Scans (without an exploitable PoC)
  • Content Spoofing Vulnerabilities
  • Denial of Service (DoS) or DDoS
  • DLL hijacking (without escalation of privileges)
  • DNS configuration related issues
  • Host Header Injection (without providing an exploitable scenario)
  • HTTP Trace method is enabled
  • Issues present in older versions of browsers, plugins, or any other software
  • Low Severity Clickjacking Vulnerabilities
  • *.devo.com web properties

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Devo's policy.

While testing

  • Respect the rules. Operate within the rules set forth here, or speak up if in strong disagreement with the rules.
  • Respect privacy. Make a good faith effort not to access or destroy another user’s data.
  • Be patient. Make a good faith effort to clarify and support their reports upon request.
  • Do no harm. Act for the common good through the prompt reporting of all found vulnerabilities. Never willfully exploit others without their permission.

Not accepted

  • Attacks involving stolen credentials or physical access to endpoint devices
  • Automated Scans (without an exploitable PoC)
  • Host Header Injection (without providing an exploitable scenario)
  • Content Spoofing Vulnerabilities
  • HTTP Trace method is enabled
  • Denial of Service (DoS) or DDoS
  • DLL hijacking (without escalation of privileges)
  • DNS configuration related issues
  • Issues present in older versions of browsers, plugins, or any other software
  • Low Severity Clickjacking Vulnerabilities

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.