Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Kontent.ai

Bug bounty on Self-hosted kontent.ai

Accepting reports Full safe harbor
Go to program Website
Top reward
$200
Top severity paid
Critical
Assets in scope
11
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $200
for critical bugs.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Paid by Amazon vouchers
No identity requirement stated.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $200
High $100
Top reward
$200 P1: $200
Safe harbor
Full Kontent.ai will not initiate a lawsuit or law enforcement investigation against you in response to reporting a vulnerability if you fully comply with this policy.
Hall of fame
Yes We would like to thank all the researchers that help us improve the security of Kontent.ai’s products and websites.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

11 assets you may test, 2 excluded.

APIs 6

  • Deliver API No bounty
  • Delivery GraphQL API No bounty
  • https://deliver.kontent.ai
  • https://graphql.kontent.ai
  • https://manage.kontent.ai/v2
  • Management API v2 No bounty

Domains 2

  • manage.kontent.ai
  • presentation website No bounty

Web 2

  • https://app.kontent.ai
  • https://kontent.ai

Source code 1

  • https://github.com/kontent-ai/mcp-server No bounty
Out of scope (2)
  • Any systems or services not expressly listed above are excluded from the scope and are not authorized for testing.
  • Any testing of public contact forms (e.g. demo request) is forbidden

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Kontent.ai's policy. "We" in these lines means the program, not this site.

While testing

  • Test vulnerabilities only on accounts you own or on accounts you have permission to test from the account holder.
  • If you inadvertently access other users’ data in your testing, please let us know, and do not store any such user data.
  • Do not use a finding to compromise/exfiltrate/modify/destroy data or to pivot to other systems. Use a proof of concept only to demonstrate an issue.
  • Do not engage in any activity that would be disruptive, damaging, or harmful to Kontent.ai, its brands, or its users.
  • Do not test third-party websites, applications, or services that integrate with Kontent.ai services without their permission.
  • Do not contact Kontent.ai Support by any means in relation to this program (pre-validating reports, testing them, asking for updates, etc.).
  • Use X-BugBounty header in your testing requests.
  • Use of automated tools and scanners is prohibited.
  • If your actions have a significant impact on availability or system performance, we will block your access.

Not accepted

  • Password leaks or credential stuffing attacks not caused by Kontent.ai (Kontent.ai does not have access to customers’ passwords)
  • Attacks requiring physical access to a users device
  • Phishing techniques
  • Disclosure of known public files or directories (e.g., robots.txt)
  • Banner disclosure on common/public services
  • HTTP/TLS configuration issues without demonstrable impact
  • Lack of Secure/HTTPOnly flags on non-sensitive cookies
  • CSP, Security header configuration suggestions
  • Presence of application or web browser 'autocomplete' or 'save password' functionality
  • CSRF on forms that are available to anonymous users
  • Username enumeration on login or forgot password pages
  • Rate limit bypasses where throttling is not in place
  • Unauthenticated cache purge
  • API key disclosure without proven business impact
  • Self-XSS that cannot be used to exploit other users
  • Absence of password length limits
  • Bypassing rate-limits or the non-existence of rate-limits
  • Host header injection without proven business impact
  • Attacks requiring man-in-the-middle or compromised user accounts
  • Cookie bomb DoS
  • CORS issues on APIs
  • Business logic / feature abuse
  • Amplitude API key exposed

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.