Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Fortinet

Vulnerability disclosure program on security.txt fortinet.com

Accepting reports Full safe harbor security.txt expired
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
10
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
https://www.fortiguard.com/faq/psirt-contact
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 1 day
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No Fortinet does not operate a bug bounty program.
Response
Within 1 days Support requests that are received via email are typically acknowledged within 24 business hours.
Safe harbor
Full We will not initiate a lawsuit or law enforcement investigation against a researcher in response to reporting a vulnerability if the researcher fully complies with this stated Policy.
Hall of fame
Yes With the agreement of the incident reporter, Fortinet PSIRT may acknowledge the reporter's contribution during the public disclosure of the vulnerability.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

10 assets you may test.

Domains 6

  • community.fortinet.com/t5/fortiguard/psirt-note-fortinet-psirt-and-monthly-psirt-advisories/ta-p/191789 No bounty
  • fortiguard.fortinet.com
  • fortiguard.fortinet.com/psirt No bounty
  • fortiguard.fortinet.com/rss/ir.xml No bounty
  • fortinet.com
  • support.fortinet.com

Android apps 1

  • Fortinet web and mobile applications, cloud services and supporting network infrastructure No bounty

Products and areas 3

  • All our products that have not reached End-of-Life (EoL) milestone. These include hardware, software and SaaS products (cloud services) and products delivered by our wholly-owned subsidiaries.
  • Fortinet Product Security Incident Response Team (PSIRT) No bounty
  • Fortinet web and mobile applications, cloud services and supporting network infrastructure.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Fortinet's policy.

While testing

  • Provide full details of the security issue including steps to reproduce and the details of the system where the tests were conducted and a clearly defined impact.
  • Refrain from accessing any non-public data.
  • limit the amount of data you access to the absolute minimum required for effectively demonstrating a Proof of Concept
  • Cause potential or actual damage to Fortinet, systems, or applications.
  • Use an exploit to view unauthorized data or to corrupt data.
  • Engage in disruptive testing including but not limited to DoS, fuzzing, automated scanning of cloud services, or any action that could impact the confidentiality, integrity, or availability of information and systems.
  • Engage in social engineering (e.g. phishing, vishing, smishing) of Fortinet employees or customers.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.