Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

HackenProof

Bug bounty on HackenProof

Accepting reports KYC to get paid Web
Go to program
Top reward
$1,500
Top severity paid
Critical
Assets in scope
4
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $1,500
for critical bugs.
Report on HackenProof
Submit through the program page.
Replies within 2 days
As the policy promises.
Payment
Proof of identity needed to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackenProof lists as the payout for each severity.

Severity Reward
Critical $1,500
Response
Within 2 days First Response 2d

Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

4 assets you may test, 1 excluded.

Web 2

  • https://dashboard.hackenproof.com
  • https://hackenproof.com

Products and areas 2

  • Dashboard
  • Main website
Out of scope (1)
  • blog.hackenproof.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from HackenProof (via HackenProof)'s policy. "We" in these lines means the program, not this site.

While testing

  • Avoid compromising any personal data, interruption or degradation of any service .
  • Don’t access or modify other user data, localize all tests to your accounts.
  • Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks or spam.
  • In case you find chain vulnerabilities we pay only for vulnerability with the highest severity.
  • Only the first valid bug is eligible for reward.
  • Don’t disclose publicly any vulnerability until you are granted permission to do so.
  • Don’t break any law and stay in the defined scope.
  • Comply with the rules of the program.
  • Don't spam forms/fields
  • Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission.

Not accepted

  • Known problems: 2FA session issues
  • UI and UX bugs and spelling or localization mistakes.
  • Descriptive error messages (e.g. Stack Traces, application or server errors)
  • Open redirects.
  • Vulnerabilities in third-party applications
  • Publicly accessible login panels without proof of exploitation.
  • Reports that state that software is out of date/vulnerable without a proof of concept.
  • Host header issues without proof-of-concept demonstrating the vulnerability.
  • HTTP codes/pages or other HTTP non-codes/pages.
  • Fingerprinting/banner disclosure on common/public services.
  • Disclosure of known public files or directories, (e.g. robots.txt).
  • Clickjacking/Tapjacking and issues only exploitable through clickjacking/tapjacking.
  • CSRF in forms that are available to anonymous users (e.g. the contact form).
  • Login & Logout CSRF
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
  • Lack of Secure/HTTPOnly flags on non-security-sensitive Cookies.
  • OPTIONS HTTP method enabled
  • Weak Captcha
  • Broken links (including social media)
  • Content injection issues.
  • HTTPS Mixed Content Scripts
  • Self-XSS that cannot be used to exploit other users
  • Reflected File Download (RFD).
  • Best practices concerns.
  • Missing HTTP security headers

Summarised with AI from the program policy on HackenProof, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackenproof.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Bug bounty Triaged by HackenProof HackenProof: Program info HackenProof Company: HackenProof Scope Review: 443546 Submissions: 1320 Total rewards: $56,815 Reputation 100 points required Program is: active now Live Submit report Program info Hackers 542 Reports 3 HackenProof is a Bug Bounty and Vulnerability Coordination Platform. We connect our customers with the global hacker community to uncover security issues in their products. By running custom-tailored bug bounty programs we help our customers significantly reduce the risk of losing their data to cybercriminals. All Scope Focus Area Program Rules Scope Search targets In scope Target │ Type │ Severity Main website Copy https://hackenproof.com │ Web │ Critical Dashboard Copy https://dashboard.hackenproof.com │ Web │ Critical Out of scope Out of scope Target │ Type │ Severity blog.hackenproof.com Copy Our Blog │ Web │ None Focus Area In-Scope Vulnerabilities We are interested in next web vulnerabilities: Business Logic Remote code execution (RCE) Database vulnerability, SQLi Cross Site Scripting (XSS) Privilege escalation Sensitive data exposure (IDOR, etc.) Authentication bypass Obtaining sensitive information Password attacks Cross-Site Request Forgery (CSRF) Server Side Request Forgery (SSRF) Out-of-Scope Vulnerabilities In general, the following vulnerabilities do not correspond to the severity threshold: Known problems: 2FA session issues UI and UX bugs and spelling or localization mistakes. Descriptive error messages (e.g. Stack Traces, application or server errors) Open redirects. 99% of open redirects have low security impact. For the rare cases where the impact is higher, e.g., stealing auth tokens, we do still want to hear about them Vulnerabilities in third-party applications Publicly accessible login panels without proof of exploitation. Reports that state that software is out of date/vulnerable without a proof of concept. Host header issues without proof-of-concept demonstrating the vulnerability. HTTP codes/pages or other HTTP non-codes/pages. Fingerprinting/banner disclosure on common/public services. Disclosure of known public files or directories, (e.g. robots.txt). Clickjacking/Tapjacking and issues only exploitable through clickjacking/tapjacking. CSRF in forms that are available to anonymous users (e.g. the contact form). Login & Logout CSRF Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality. Lack of Secure/HTTPOnly flags on non-security-sensitive Cookies. OPTIONS HTTP method enabled Lack of Security Speed bump when leaving the site. Weak Captcha Broken links (including social media) Content injection issues. HTTPS Mixed Content Scripts Content Spoofing without embedded links/html Self-XSS that cannot be used to exploit other users (this includes having a user paste JavaScript into the browser console). Reflected File Download (RFD). Best practices concerns. Highly speculative reports about theoretical damage. Be concrete. Missing HTTP security headers, specifically, For e.g. Missing rate limit in forms, fields Cookie reusing Strict-Transport-Security X-Frame-Options X-XSS-Protection Host Header X-Content-Type-Options Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP Content-Security-Policy-Report-Only Infrastructure vulnerabilities, including: Certificates/TLS/SSL related issues DNS issues (i.e. mx records, SPF records, DMARC records, etc.) Server configuration issues (i.e., open ports, TLS, etc.) Outdated web browsers: vulnerabilities contingent upon outdated or unpatched browsers will not be honored, including Internet Explorer all versions Vulnerabilities involving active content such as web browser add-ons XSS issues that affect only outdated browsers (like Internet Explorer) Issues that require physical access to a victim’s computer. Physical or social engineering attempts (this includes phishing attacks against employees). Recently disclosed 0day vulnerabilities. Microsites with little to no user data Most brute forcing issues Denial of service Spamming! Session fixation Program Rules Avoid compromising any personal data, interruption or degradation of any service . Don’t access or modify other user data, localize all tests to your accounts. Don’t exploit any DoS/DDoS vulnerabilities, social engineering attacks or spam. In case you find chain vulnerabilities we pay only for vulnerability with the highest severity. Only the first valid bug is eligible for reward. Don’t disclose publicly any vulnerability until you are granted permission to do so. Don’t break any law and stay in the defined scope. Comply with the rules of the program. Don't spam forms/fields Any details of found vulnerabilities must not be communicated to anyone who is not a HackenProof Team or an authorized employee of this Company without appropriate permission. Live since 09 Oct 2019 Published date 09 Oct 2019 Last updated 24 Aug 2026 Range of bounty $50 - $1,500 Severity Critical $1,200 - $1,500 High $700 - $900 Medium $200 - $300 Low $50 - $100 Web @TriageTeam 1 @dglabz KYC 2 @Bugtester KYC Verified 3 @Jarvis Verified 4 @murat-kekic 5 Response type Business days First Response 2d Triage Time 3d Reward Time 3d Resolution Time 10d