- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report through their form
- hackerone.com/icann
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Safe harbor
-
Partial
Failure to meet the above conditions and requirements may be considered a breach of responsible disclosure guidelines and eliminate any potential recognition of the submitted research contribution.
- Hall of fame
-
Yes
ICANN sincerely appreciates responsible disclosure of vulnerabilities from all parties and will make efforts to provide appropriate recognition of those individuals who follow ICANN's disclosure guidelines.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test.
Domains 1
- icann.org
Products and areas 1
- ICANN Organization Online Services
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Icann's policy.
While testing
-
results in a degradation of ICANN systems,
-
results in you, or any third party, accessing, storing, sharing or destroying ICANN or customer data, or
-
may impact the ICANN community, such as denial of service, social engineering or spam.
-
Uploading files that allow arbitrary commands ( e.g., a webshell).
-
Modifying any files or data, including permissions.
-
Deleting any files or data.
-
Interrupting normal operations (e.g., triggering a reboot).
-
Creating and maintaining a persistent connection to the server.
-
Intentionally viewing any files or data beyond what is needed to prove the vulnerability.
-
Failing to disclose any actions taken or applicable required information.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.