Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Hack The Box

Vulnerability disclosure program on HackerOne hackthebox.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
11
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report through their form
hackerone.com/hack_the_box
Replies within 5 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Response
Within 5 days Acknowledge valid reports within 5 business days

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

11 assets you may test.

Web 11

  • api.jobs.hackthebox.com Critical No bounty
  • https://academy.hackthebox.com Critical No bounty
  • https://account.hackthebox.com Critical No bounty
  • https://app.hackthebox.com Critical No bounty
  • https://ctf.hackthebox.com Critical No bounty
  • https://enterprise.hackthebox.com Critical No bounty
  • https://jobs.hackthebox.com Critical No bounty
  • https://profile.hackthebox.com Critical No bounty
  • https://range.hackthebox.ai Critical No bounty
  • https://status.hackthebox.com Critical No bounty
  • labs.hackthebox.com Critical No bounty

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Hack The Box (via HackerOne)'s policy.

While testing

  • Use only your own personal HTB account
  • Respect the platform – no abuse, persistence, or lateral movement
  • Minimize impact – test only to the extent required to prove risk
  • Automated scanning, crawling, or fuzzing without prior written authorization
  • Engaging in social engineering, phishing, pretexting, impersonation, or other deceptive behaviors targeting individuals, staff, or systems.
  • Submitting, storing, or including any sensitive data (e.g., credentials, cookies, tokens, logs, personal data) in reports, communications, or third-party tools.

Not accepted

  • Theoretical or low-risk issues
  • Duplicate or previously known bugs
  • Scanner output with no proof-of-impact

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 30 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://profile.hackthebox.com

  2. Scope added

    https://range.hackthebox.ai/

  3. Scope added

    api.jobs.hackthebox.com

  4. Scope added

    https://academy.hackthebox.com/

  5. Scope added

    https://account.hackthebox.com

  6. Scope added

    https://app.hackthebox.com/

  7. Scope added

    https://ctf.hackthebox.com

  8. Scope added

    https://enterprise.hackthebox.com

  9. Scope added

    https://jobs.hackthebox.com/

  10. Scope added

    https://status.hackthebox.com/

  11. Scope added

    labs.hackthebox.com

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

The following summary outlines key rules and expectations but does not substitute the official VDP Terms, which you are required to read in full before engaging in any testing activity.

Participation in this Vulnerability Disclosure Program is strictly subject to your acceptance and continuous compliance with the full VDP Terms, which are legally binding and take precedence over any summary or guidance provided here.

By initiating any testing or submitting a report, you confirm that you have read, understood, and agreed to be bound by the latest version of the VDP Terms.

Program Scope

Hack The Box authorizes vulnerability research only on systems that it directly owns and operates. Testing is permitted exclusively on assets explicitly listed as in-scope. Any activity beyond this scope is strictly prohibited and not protected by Safe Harbor.

The following are considered in-scope assets:

All other systems, subdomains, integrations, or services—including third-party tools or unlisted assets—are out-of-scope and must not be tested.

Testing Rules (What’s Allowed)

  • Use only your own personal HTB account
  • Respect the platform – no abuse, persistence, or lateral movement
  • Minimize impact – test only to the extent required to prove risk
  • Communicate respectfully and professionally
  • Ask for clarification on edge cases via HackerOne Platform
  • Comply with all prohibited actions below

Strictly Prohibited Activities

  • Testing systems or services not explicitly listed as in-scope, including unlisted subdomains, external platforms, third-party tools, and services not operated by Hack The Box.
  • Accessing, interacting with, or simulating other users’ accounts, data, or sessions, including mimicking customer environments or generating synthetic data that resembles real user activity.
  • Submitting, storing, or including any sensitive data (e.g., credentials, cookies, tokens, logs, personal data) in reports, communications, or third-party tools.
  • Performing any action—manual or automated—that disrupts, degrades, or impairs the performance, availability, or functionality of Hack The Box services or infrastructure, including:
    • DoS attacks
    • Credential stuffing, brute-force attacks, or rate abuse
    • Automated scanning, crawling, or fuzzing without prior written authorization
    • Automated account creation or script-driven interactions (bots)
  • Engaging in social engineering, phishing, pretexting, impersonation, or other deceptive behaviors targeting individuals, staff, or systems.
  • Attempting to physically access Hack The Box premises, equipment, infrastructure, or networks.
  • Uploading credentials, tokens, or other secrets to third-party repositories, tooling platforms, pastebins, or external services.
  • Violating applicable laws or regulations, or engaging in any conduct that creates legal, operational, reputational, or security risks for Hack The Box, its users, or its partners.

Valid Findings

We welcome high-impact, well-documented reports that affect in-scope assets and demonstrate a clear, real-world security impact. Focus areas include vulnerabilities that:

  • Allow unauthorized access to accounts, data, or internal systems
  • Break authentication or session mechanisms
  • Escalate privileges or bypass user boundaries
  • Exploit flawed business logic or access control

Valid examples include (but are not limited to):

  • Remote Code Execution (RCE)
  • SQL Injection (SQLi)
  • Server-Side Request Forgery (SSRF)
  • Authentication bypass or session issues
  • Privilege escalation
  • IDOR, XSS, CSRF
  • Business logic abuse
  • Unauthorized admin access

We do not accept:

Please ensure your submission includes clear steps to reproduce, evidence of impact, and relevant context. We prioritize quality and actionable reports.

Report Quality

Reports must be clear, complete, and reproducible.

  • Include:
    • A concise title
    • Step-by-step reproduction (URLs, roles, payloads, etc.)
    • Expected vs. actual behavior
    • Real-world impact
    • Supporting evidence (PoC, screenshots, logs)
  • Submit one report per issue (unless chaining is essential)
  • Group related bugs only if they share a root cause
  • First valid report gets recognition
  • Follow:

Timelines

We aim to:

  • Acknowledge valid reports within 5 business days
  • Provide initial status updates within 10 business days
  • Coordinate disclosure within 90 days where feasible

Safe Harbor

We align with Gold Standard Safe Harbor (relevant FAQ):

As long as you act in good faith, follow the VDP Terms, and stay within scope, we will:

  • Not take legal action against you
  • Not suspend your HTB account
  • Affirm the research as Good Faith Security Research if questioned by a third party

Safe Harbor does not apply if you fail to comply with applicable laws or VDP Terms.