Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Icinga

By Icinga GmbH Vulnerability disclosure program on Self-hosted icinga.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
8
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 3 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No We do not currently run a paid bug bounty programme.
Response
Within 3 days We confirm we have received your report, usually within a few working days.
Safe harbor
Full If you make a genuine effort to comply with this policy while investigating and reporting an issue, we will not pursue or support legal action against you for that research.
Hall of fame
Yes We are glad to credit researchers in our advisories for the vulnerabilities they report, where they wish to be named.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

8 assets you may test.

Wildcard domains 2

  • *.icinga.com No bounty
  • web services operated by icinga under icinga.com and its subdomains

Domains 1

  • icinga.com

Web 1

  • icinga.com and its subdomains

Products and areas 4

  • Icinga products and components published by Icinga GmbH, including Icinga 2, Icinga Web, Icinga DB, Icinga Director, and the modules and agents Icinga maintains
  • Icinga products and components published by Icinga GmbH, including their releases and packages.
  • Third-party or open-source components integrated into an Icinga product, where the vulnerability affects the product as Icinga ships it
  • Third-party or open-source components integrated into an Icinga product, where the vulnerability affects the product as we ship it.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Icinga's policy. "We" in these lines means the program, not this site.

While testing

  • Report the issue to us promptly and give us reasonable time to respond before disclosing it to anyone else.
  • Only interact with accounts and systems you own or have explicit permission to test.
  • Avoid privacy violations, data destruction, service degradation, and any disruption to our users or infrastructure.
  • Do not access, modify, or retain more data than is necessary to demonstrate the issue, and delete any such data once it has been reported.

Not accepted

  • bugs, feature requests, and general questions that are not security-related

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.