Discord
Bug bounty on security.txt discord.com
- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 17
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Based on the validity, severity, and scope of each issue, we'll reward you with awesome shtuff (or just cold, hard cash if you prefer).
- Response
-
Within 1 days
Vulnerability reports will always be responded to as fast as possible—usually within 24 hours.
- Safe harbor
-
Full
Discord will not take legal action against users for disclosing vulnerabilities as instructed here.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
17 assets you may test, 7 excluded.
Domains 3
- discordapp.com
- discord.com
- discordsays.com
Products and areas 14
- Blazing 8s
- Bobble Bash
- Bobble League
- Checkers in the Park
- Chess in the Park
- Know What I Meme
- Land-io
- Letter League
- Poker Night
- Putt Party
- sites and services that Discord directly operates
- Sketch Heads
- Watch Together
- Whiteboard
Out of scope (7)
- blog.discord.com
- feedback.discord.com
- merch.discordapp.com
- status.discord.com
- support.discord.com
- Any Activity not explicitly defined above
- Any third party providers or partners proxied by the discordsays.com domain
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Discord's policy. "We" in these lines means the program, not this site.
While testing
-
Only use and test on accounts and servers you directly own. Testing should never affect other users.
-
Testing should be limited to sites and services that Discord directly operates.
-
Don't perform any actions that could harm the reliability or integrity of our services and data.
-
Don't use scanners or automated tools to find vulnerabilities.
-
No information about issues found should be publicly disclosed or shared until we've completed our investigation and resolution.
Not accepted
-
Account/E-mail enumeration
-
Attacks requiring MITM or physical access to a user's device
-
AutoMod bypasses
-
Brute force attacks
-
Clickjacking
-
Content spoofing and text injection
-
CSRF vulnerabilities
-
Denial of Service attacks where the outcome is resource exhaustion
-
Email SPF, DKIM, and DMARC records
-
Family Center audit log integrity
-
Invite enumeration
-
Missing HttpOnly/Secure cookie flags
-
NSFW gating
-
Open CORS headers
-
Publicly accessible login panels
-
Rate limiting (temporarily)
-
Reports from scanners and automated tools
-
Self-exploitation (like token reuse and console scripting)
-
Social engineering or phishing attacks targeting users or staff
-
Linking to an unsafe file or resource which requires the user to interact to open the link
-
Bypassing unsafe link warnings
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.