Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Divar

Bug bounty on security.txt divar.ir

Accepting reports Full safe harbor security.txt expired mentions bounty
Go to program Website
Top reward
$5,500
Top severity paid
Critical
Assets in scope
19
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $5,500
for critical bugs, from $125.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $5,500
High $1,750
Medium $500
Top reward
$5,500 Critical Up to 5,500$
Lowest reward
$125 Medium Vulnerability Severity 500$ 250$ 125$
Safe harbor
Full If you conduct your research in good faith and within the framework of this program, Divar considers your activity authorized and will not take legal or judicial action against you.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

19 assets you may test, 4 excluded.

Domains 10

  • agahpardazan.ir
  • api.divar.ir
  • divar.cloud
  • divar.dev
  • divar.io
  • divar.ir
  • git.divar.cloud
  • grpc-api.divar.ir
  • mail.divar.ir
  • registry.divar.cloud

Wildcard domains 6

  • agahpardazan.ir.*
  • api.*.divar.cloud
  • divar.cloud.*
  • divar.dev.*
  • divar.io.*
  • m.divar.ir.*

Android apps 1

  • Divar Mobile App - Android Version

iOS apps 1

  • Divar Mobile App - iOS Version

Products and areas 1

  • Business Panels
Out of scope (4)
  • divar.news
  • git.divar.cloud
  • registry.divar.cloud
  • api.*.divar.cloud

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Divar's policy.

While testing

  • You only test the assets listed in the "Scope" section.
  • You follow the rules in the "Protecting Users While Testing" section.
  • You report the vulnerability immediately after discovering it and do not abuse it.
  • You do not share any details with anyone until the vulnerability is fixed and a coordinated disclosure is agreed upon.
  • Only use accounts that belong to you, or a test account created with prior coordination.
  • Stop testing as soon as you come across the first piece of real user data, and report the issue.
  • Do not download, retain, publish, or hand over user data to anyone else.
  • Do not modify or delete any data, and do not establish persistence.
  • Delete any user data you obtained during testing once you have submitted your report.
  • Do not degrade the quality of the service; denial-of-service attacks, bulk messaging, and spamming real users are not allowed.

Not accepted

  • CSRF Injections
  • Internal Open Redirect Vulnerabilities
  • Social Engineering and Phishing Attacks, Physical Attacks, Spamming
  • DoS and DDoS Attacks
  • Brute Forcing Accounts
  • Homographs or Similar Attacks
  • Failure to Apply Security Considerations on Cookies
  • Lack of or Weak Captcha
  • Clickjacking with No Sensitive Actions
  • Failure to Follow Security Best Practices Without Exploit
  • Vulnerabilities Requiring Highly Specific User Interaction
  • Vulnerabilities Related to Outdated Browsers
  • Self XSS
  • Third-party Software and Systems, If Access and Bug Patchability Are Not Possible, Are Considered Out of Scope
  • Vulnerabilities Reported by Scanners and Other Automated Tools Without Exploit
  • Reports of Low Versions of Libraries and Software Used Without Exploit
  • Vulnerabilities Related to Server Information Leaks and Incorrect Configurations Without Exploit
  • Vulnerabilities Related to Rate Limit and User Enumeration, Unless Leading to a Higher Severity
  • Reflected File Download
  • Clickjacking
  • Failure to Implement Security Headers

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 3 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.