Hackrate

By HACKRATE Kft. Vulnerability disclosure program on Self-hosted hckrt.com

Accepting reports

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No HACKRATE currently does not offer rewards.
Safe harbor: Partial Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of HACKRATE’s services.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

41 assets you may test, 1 excluded.

Out of scope (1)

What the policy asks of you, and the bug types it won't reward, quoted from Hackrate's policy. "We" in these lines means the program, not this site.

Testing is only authorized on the targets listed as Scope.
Any domain/property/database/IP address of HACKRATE not listed in the Scope section is strictly out of scope.
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of HACKRATE’s services.
Only interact with accounts you own.
The use of automated scanners is prohibited.
HACKRATE requests that testers do not perform automated/scripted testing of web forms, especially "Contact Us" forms.
If you find the same vulnerability several times, please create only one report.
Use your letmehack.it e-mail alias for testing.

Open ports without an accompanying proof-of-concept demonstrating vulnerability
Design flaws and best practices that do not lead to security vulnerabilities
Weak/expired SSL configurations
Vulnerabilities affecting users of outdated browsers
Missing security best practices and controls (lack of CSRF protection, missing HttpOnly or secure flags on cookies, missing XSS-Protection HTTP header)
Self XSS
Software version disclosure
Low impact session management issues
Lack of strong password policy
Internal IP disclosure
Rate-limiting issues
Lack of captcha's or other spam-preventing mechanisms
Content spoofing and text injection issues
User Enumeration
Open redirects
Clickjacking on pages with no sensitive actions
DNS server misconfiguration, lack of DNS CAA, and DNS-related configurations
Absence of SPF / DKIM / DMARC records
Mixed content warnings
Credential stuffing and the use of leaked credentials are considered as Informative and not eligible for rewards

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake