Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

DuckDuckGo

Vulnerability disclosure program on HackerOne duckduckgo.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
4
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Replies within 2 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Pays cash
No We are not offering monetary bounties at this time, however, we would love to send you some swag for valid submissions.
Response
Within 2 days Time to first response (from report submission) - 2 business days

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

4 assets you may test.

Android apps 1

  • com.duckduckgo.mobile.android Critical No bounty

iOS apps 1

  • com.duckduckgo.mobile.ios Critical No bounty

Source code 1

  • https://github.com/duckduckgo/duckduckgo-privacy-extension Critical No bounty

Wildcard domains 1

  • *.duckduckgo.com Critical No bounty

Rules

What the policy asks of you, and the bug types it won't reward, quoted from DuckDuckGo (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Please provide detailed reports with reproducible steps.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • Make a good faith effort to avoid destruction of data, and interruption or degradation of our service.
  • Please do not discuss vulnerabilities (even resolved ones) outside of the program without express consent from DuckDuckGo.

Not accepted

  • Open proxy reports.
  • SSRF on proxy reports.
  • Clickjacking on pages with no sensitive actions.
  • Previously known vulnerable libraries without a working Proof of Concept.
  • Any activity that could lead to the disruption of our service (DoS).
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
  • Self-XSS without a plausible attack vector.
  • WebView issues we have no control over

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 19 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

DuckDuckGo is the Internet privacy company for everyone who wants to take back their privacy online now. For over a decade, we've built features, created new technology, and worked with policymakers to make online privacy simple and accessible for all. Our product is one supercharged app with multiple types of privacy protection: Private Search, Web and App Protection, Email Protection, & more.

We're committed to set the new standard of trust online, and we look forward to working with the security community to find security vulnerabilities in order to keep our users safe. Check out more about us on https://duckduckgo.com.

SLA

DuckDuckGo will make a best effort to meet the following SLAs for hackers participating in our program:

  • Time to first response (from report submission) - 2 business days
  • Time to triage (from first response) - 2 business days
  • Time to resolution - depends on severity and complexity.

We’ll try to keep you informed about our progress throughout the process.

Disclosure Policy

  • Follow HackerOne's disclosure guidelines.
  • Please do not discuss vulnerabilities (even resolved ones) outside of the program without express consent from DuckDuckGo.

Program Rules

  • Please provide detailed reports with reproducible steps.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • Make a good faith effort to avoid destruction of data, and interruption or degradation of our service.
  • When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug.

Rewards

We are not offering monetary bounties at this time, however, we would love to send you some swag for valid submissions.

Out of scope vulnerabilities

The following issues are considered out of scope:

  • Open proxy reports.
  • SSRF on proxy reports.
  • Clickjacking on pages with no sensitive actions.
  • Previously known vulnerable libraries without a working Proof of Concept.
  • Any activity that could lead to the disruption of our service (DoS).
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
  • Self-XSS without a plausible attack vector. ==* WebView issues we have no control over - you can still report them if you're unsure, but be aware they might be closed as informative==

Out of scope endpoints

The following endpoints are considered out of scope:

  • va-ddgc-staging-web1.duckduckgo.com
  • va-ddgc-staging-web2.duckduckgo.com
  • duck.co

Thank you for helping keep DuckDuckGo and our users safe!