Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Hostinger

Bug bounty on Self-hosted hostinger.com

Accepting reports
Go to program Website
Top reward
$25,000
Top severity paid
Not published
Assets in scope
10
Public CVEs
1
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $25,000
top reward, from $100.
Report by email
[email protected]
Partial safe harbor
Some legal protection; read the terms.
Replies within 2 days
As the policy promises.
Paid by USD
No identity requirement stated.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

The old policy link stopped working, so we followed the company's security.txt to the current policy.

The policy page has no reward table. Here is what it says, in its own words.

Top reward
$25,000 the maximum Bounty Payment for a validated vulnerability report is $25,000 (USD).
Lowest reward
$100 The minimum Bounty Payment for a validated vulnerability report is $100 (USD)
Response
Within 2 days First Response │ 2 business days
Safe harbor
Partial Hostinger commits that, if we conclude, in our sole discretion, that your activities comply with these Program Terms, and the Terms of Service, Hostinger will not pursue a civil claim against you solely in connection with your compliant security research or refer the matter to law enforcement.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

10 assets you may test, 2 excluded.

Domains 10

  • agents.hostinger.com
  • builder.hostinger.com
  • cpanel.hostinger.com
  • horizons.hostinger.com
  • hostinger.com
  • hpanel.hostinger.com
  • mail.hostinger.com
  • payments.hostinger.com
  • reach.hostinger.com
  • www.hostinger.com
Out of scope (2)
  • Any Site, Service, domain, asset, customer hosted content, or third-party software that is not included within the Bug Bounty Program scope
  • Issues related to the cPanel platform itself

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Hostinger's policy.

While testing

  • you shall not modify any files or data, including permissions, and shall not intentionally view or access any data beyond what is needed to prove the vulnerability.
  • You must register your own Account and purchase a Single Shared Hosting plan.
  • Directly injecting benign commands via the web application or interface (e.g. whoami, hostname, ifconfig)
  • Uploading a file that outputs the result of a hard-coded benign command
  • Uploading files that allow arbitrary commands (i.e. a webshell)
  • Modifying any files or data, including permissions
  • Deleting any files or data
  • Interrupting normal operations (e.g. triggering a reboot)
  • Creating and maintaining a persistent connection to the server

Not accepted

  • Username enumeration on customer facing systems
  • Scanner output or scanner-generated reports
  • Man-in-the-Middle attacks
  • Any physical attacks against Hostinger property or data centers
  • Cross Site Scripting (XSS)
  • Cross Site Request Forgery (CSRF)
  • Click-jacking
  • Vulnerabilities involving stolen credentials or physical access to a device
  • Phishing attacks
  • Social engineering attacks
  • Open redirection
  • CRIME/BEAST attacks
  • Logout CSRF
  • Banner or version disclosures
  • Missing SPF records
  • Directory listing (unless sensitive data can be found)
  • DoS, brute force, user enumeration or DDoS attacks
  • Blackhat SEO techniques
  • Vulnerabilities on third party libraries without showing specific impact to the target application
  • Exposed credentials that are either no longer valid, or do not pose a risk to an in scope asset
  • Any bug that relies upon an outdated browser
  • Issues related to SSL certificates
  • DNS configuration issues
  • Server configuration issues (e.g., open ports, TLS versions, etc.)
  • Insecure password complexity requirements

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2023-6751 High 7.3 11 Jan 2024