Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

KelasHack

Vulnerability disclosure program on Self-hosted kelashack.id

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
5
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Replies within 2 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No Kami belum kasih bounty dalam bentuk uang.
Response
Within 2 days Target respon pertama dari kami maksimal 2 hari kerja.
Hall of fame
Yes Nama kamu masuk daftar kontributor keamanan KelasHack, kecuali kamu minta anonim.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

5 assets you may test, 6 excluded.

Domains 2

  • kelashack.id
  • kelashack.id (web utama)

APIs 1

  • Endpoint API publik di *.kelashack.id/*

Wildcard domains 1

  • semua subdomain production *.kelashack.id

Products and areas 1

  • Alur autentikasi, pembayaran, dan dashboard siswa
Out of scope (6)
  • Brute force, rate-limit bypass, DoS, atau DDoS
  • Bug di browser, ekstensi, atau perangkat pengguna
  • Hasil mentah automated scanner tanpa PoC manual
  • Phishing atau social engineering ke tim maupun siswa
  • Preview URL pihak ketiga (Vercel preview, staging tidak resmi)
  • Self-XSS yang butuh korban menempelkan payload sendiri

Rules

What the policy asks of you, and the bug types it won't reward, quoted from KelasHack's policy.

While testing

  • Tes hanya di akun milikmu sendiri
  • Berhenti dan lapor segera setelah celahnya terkonfirmasi
  • Jaga data siswa lain seperti datamu sendiri
  • Bertanya lewat email jika ragu terkait testing
  • Bocorkan detail celah ke publik sebelum kami fix
  • Akses, salin, atau ubah data milik user lain
  • Pakai bug untuk keuntungan pribadi
  • Lakukan tindakan yang bisa mengganggu uptime layanan

Not accepted

  • Brute force, rate-limit bypass, DoS, atau DDoS
  • Phishing atau social engineering ke tim maupun siswa
  • Preview URL pihak ketiga (Vercel preview, staging tidak resmi)
  • Bug di browser, ekstensi, atau perangkat pengguna
  • Self-XSS yang butuh korban menempelkan payload sendiri
  • Hasil mentah automated scanner tanpa PoC manual

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.