Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Jumpcloud

Vulnerability disclosure program on Self-hosted jumpcloud.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
12
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Replies within 7 days
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No At present, we can only offer non-cash rewards, including: A gift card from Amazon (www.amazon.com)
Response
Within 7 days We will make every effort to respond to accurate reports within seven business days.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

12 assets you may test, 3 excluded.

Domains 10

  • agent.jumpcloud.com
  • console.jumpcloud.com
  • events.jumpcloud.com
  • google-sync.jumpcloud.com
  • kickstart.jumpcloud.com
  • ldap.jumpcloud.com
  • o365-sync.jumpcloud.com
  • private-kickstart.jumpcloud.com
  • radius.jumpcloud.com
  • sso.jumpcloud.com

Products and areas 2

  • JumpCloud Agents No bounty
  • JumpCloud Agents ( endpoints deployed to systems )
Out of scope (3)
  • jumpcloud.com
  • support.jumpcloud.com
  • Vulnerabilities on sites hosted by third parties unless they lead to a weakness on any scoped endpoint.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Jumpcloud's policy. "We" in these lines means the program, not this site.

While testing

  • You give us a reasonable time to investigate and mitigate an issue you report before making public any information about the report or sharing such information with others.
  • You make a reasonable faith effort to avoid privacy violations and disruptions to others, including (but not limited to) unauthorized access to or destruction of data and interruption or degradation of our services.
  • You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for further problems.)
  • You do not intentionally violate any other applicable laws or regulations, including (but not limited to) laws and regulations prohibiting unauthorized access to data.
  • For this policy, you are not authorized to access user data or company data, including (but not limited to) personally identifiable information and data relating to an identified or identifiable natural person.
  • Don’t violate the Terms of Service (including but not limited to performing unauthorized penetration tests).
  • Don’t violate the privacy of other users, destroy data, disrupt our services, etc.
  • Only target your accounts in the process of investigating any bugs/findings. Don’t focus, attempt to access, or otherwise disrupt the accounts of other users.
  • Don’t target our physical security measures or attempt to use social engineering, spam, or distributed denial of service (DDOS) attacks.
  • If you find a severe vulnerability that allows system access, you must not proceed further.

Not accepted

  • Social Engineering
  • Lack of rate-limiting mechanisms
  • Open redirects without a severe impact
  • Application stack traces (path disclosures, etc.)
  • Self-type Cross-Site Scripting / Self-XSS
  • Vulnerabilities that require Man in the Middle (MiTM) attacks
  • Denial of Service attacks
  • CSRF issues on actions with minimal impact
  • Cache Poisoning
  • Clickjacking
  • Incomplete or missing SPF/DMARC/DKIM records
  • HSTS not enabled on *.jumpcloud.com websites
  • Brute force attacks
  • Security practices (banner revealing a software version, missing security headers, etc.)
  • Bugs that do not have security implications
  • Vulnerabilities on sites hosted by third parties unless they lead to a weakness on the main website
  • Vulnerabilities are contingent on physical attack, social engineering, spamming, DDOS attack, etc.
  • Vulnerabilities affecting outdated or unpatched browsers/operating systems
  • Bugs already are known to us, or previously reported by someone else (reward goes to the first reporter)
  • Issues that aren’t reproducible

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.