Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

EC-Council

Vulnerability disclosure program on Self-hosted eccouncil.org

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
2
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
https://www.eccouncil.org/bug-bounty
Replies within 7 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No The rewards cannot be redeemed or exchanged for its monetary value or in lieu of any other product.
Response
Within 7 days The minimum time to acknowledge a vulnerability after submission is 7-30 working days
Hall of fame
Yes 2) Inclusion in Hall of Fame │ All

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

2 assets you may test, 3 excluded.

Domains 1

  • eccouncil.org

Wildcard domains 1

  • all ec-council’s websites including sub domains and any third party web properties inside ec-council’s websites
Out of scope (3)
  • e.g.ssl
  • third party websites/services for which EC-Council acts as a subscriber for resource sharing
  • Websites which are in beta/under development/staging sites

Rules

What the policy asks of you, and the bug types it won't reward, quoted from EC-Council's policy.

While testing

  • Vulnerability disclosures should remain confidential and can’t be disclosed to third parties.
  • Any details of disclosures should not be posted in public platforms/Social networks until remediation and acknowledgement is obtained from EC-Council.
  • The bug must be original and previously unreported.
  • Bounty can’t be claimed by a single user with multiple identities
  • Any vulnerabilities reported by the candidates will be considered as one across all EC-Council’s websites and candidates can’t claim a reward per website.
  • A proof of concept needs to be submitted by the candidate which is irreversible until the remediation if the vulnerability.

Not accepted

  • Descriptive error messages (e.g. Stack Traces, application or server errors).
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages.
  • Fingerprinting / banner disclosure on common/public services.
  • Disclosure of known public files or directories, (e.g. robots.txt).
  • Clickjacking and issues only exploitable through clickjacking.
  • CSRF on forms those are available to anonymous users (e.g. the contact form).
  • Logout Cross-Site Request Forgery (logout CSRF).
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
  • Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
  • Weak Captcha / Captcha Bypass
  • Forgot Password page brute-force and account lockout not enforced.
  • OPTIONS HTTP method enabled
  • Username / email enumeration via Login Page error message via Forgot Password error message
  • Missing HTTP security headers
  • SSL Issues, e.g.SSL Attacks such as BEAST, BREACH, Renegotiation attack
  • Email Security – SPF, DMARC, DKIM

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.