Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

IronCore Labs

Vulnerability disclosure program on Self-hosted ironcorelabs.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
5
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
https://ironcorelabs.com/trust-center/responsible-disclosure-program
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No As of October 1, 2026, IronCore no longer offers rewards for found vulnerabilities.
Safe harbor
Partial Research in good faith.
Hall of fame
Yes We still welcome reports of real flaws and issues and we will still offer recognition for any qualifying report.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

5 assets you may test, 4 excluded.

Domains 3

  • admin.ironcorelabs.com
  • api.ironcorelabs.com
  • ironcorelabs.com

Source code 2

  • recrypt-rs: transform encryption library
  • Web SDK
Out of scope (4)
  • github.com
  • ironcorelabs.com
  • npmjs.com
  • HubSpot and other non-IronCore properties

Rules

What the policy asks of you, and the bug types it won't reward, quoted from IronCore Labs's policy. "We" in these lines means the program, not this site.

While testing

  • Vulnerability reports MUST have a proof of concept or detailed step-by-step explanation of the security issue so we can reproduce it.
  • Never publicly disclose customer information.
  • Only publicly disclose a vulnerability with our specific consent.
  • Please be sure to avoid harming infrastructure, interacting with customers, and attempting to access, manipulate, and/or attack accounts you do not explicitly own.
  • Please don't create an excessive number of accounts for testing.
  • Avoid using site-wide scanners.
  • Be mindful with the rate and scope of automated scanning tools.
  • You must be at least 18 years of age to participate.
  • Don't leave any system that you are accessing in a worse state than when you found it.
  • We do not respond to extortion or abusive or threatening language.

Not accepted

  • DoS/DDoS
  • Service disruptions
  • Physical attacks, social engineering attacks, and phishing attacks of any kind.
  • 3rd party systems and solutions (any resource / service not managed by IronCore Labs).
  • Spam or any other mass distribution to customers, partners, etc.
  • Customer support channels (chat, phone, email, etc.)
  • Security reports that don't pertain to IronCore Labs
  • Flaws specific to out of date browsers/plugins.
  • Browser functions controlled by the client, such as if a vulnerability is found in a specific implementation of the Web Crypto API.
  • Malicious code running on a host site
  • Malicious code running in a browser plugin
  • Simple, non-XSS content injection
  • Cross-site request forgery.
  • Clickjacking, as well as any issues only exploitable through clickjacking.
  • Lack of the Secure flag on non-sensitive cookies.
  • Lack of subresource integrity tags.
  • Cross-site Request Forgery issues submitted with a proof-of-concept containing a nonce.
  • Vulnerabilities identified with automated tools (including web scanners) that do not include proof of concept code or a demonstrated exploit.
  • Descriptive error messages.
  • HTTP 404 or other HTTP error codes/ pages.
  • Disclosure of known public files or directories
  • Spelling errors , UI and UX bugs.
  • Reports of missing SPF records for domains with no MX record

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope

    − Web SDK: may be downloaded, − ironcorelabs.com, − npmjs.com and 1 more

  2. Scope

    − https://ironcorelabs.com/docs

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.