Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

GSA Bounty

By GSA Bug bounty on HackerOne gsa.gov

Paused
Go to program Website
Top reward
$3,000
Top severity paid
Critical
Assets in scope
46
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $3,000
for critical bugs.
Report on HackerOne
Submit through the program page.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $3,000
High $1,000
Medium $500
Low $250

Scope

46 assets you may test, 11 excluded.

Web 33

  • account.fr.cloud.gov Critical
  • admin-catalog-bsp.data.gov Critical
  • admin.fr.cloud.gov Critical
  • alertmanager.fr.cloud.gov Critical
  • api.data.gov Critical
  • api.fr.cloud.gov Critical
  • catalog.data.gov Critical
  • ci.fr.cloud.gov Critical
  • cloud.gov Critical
  • dashboard-beta.fr.cloud.gov Critical
  • dashboard.fr.cloud.gov Critical
  • diagrams.fr.cloud.gov Critical
  • federalist.18f.gov High
  • federalist-docs.18f.gov Medium
  • federalist-proxy.app.cloud.gov Critical
  • federation.data.gov Critical
  • grafana.fr.cloud.gov Critical
  • idp.fr.cloud.gov Critical
  • inventory.data.gov Critical
  • labs.data.gov Critical
  • login.fr.cloud.gov Critical
  • logs.fr.cloud.gov Critical
  • logs-platform.fr.cloud.gov Critical
  • marketplace.fedramp.gov Critical
  • nessus.fr.cloud.gov Critical
  • opslogin.fr.cloud.gov Critical
  • prometheus.fr.cloud.gov Critical
  • sdg.data.gov Critical
  • ssh.fr.cloud.gov Critical
  • tock.18f.gov Critical
  • www.data.gov Critical
  • www.fedramp.gov Critical
  • www.usa.gov Critical

Source code 10

  • https://github.com/18f/docker-ruby-ubuntu No bounty
  • https://github.com/18f/federalist No bounty
  • https://github.com/18f/federalist-builder No bounty
  • https://github.com/18f/federalist-docker-build No bounty
  • https://github.com/18f/federalist-proxy No bounty
  • https://github.com/18f/identity-idp No bounty
  • https://github.com/18f/identity-saml-rails No bounty
  • https://github.com/18f/identity-saml-sinatra No bounty
  • https://github.com/gsa/data.gov No bounty
  • https://github.com/gsa/datagov-deploy No bounty

Wildcard domains 3

  • *.code.gov No bounty
  • *.login.gov No bounty
  • *.search.gov No bounty
Out of scope (11)
  • data.gov applications
  • http://github.com/18f/identity-saml-java
  • http://github.com/18f/identity-saml-python
  • 18f.gov
  • 18f.gsa.gov
  • all-sorns.app.cloud.gov
  • manage.data.gov
  • vote.gov
  • *.app.cloud.gov
  • *.cloud.gov
  • *.data.gov

Changes

Tracked since 12 Nov 2026. Last checked 31 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.