Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

LINE Security Bug Bounty

By LY Corporation Vulnerability disclosure program on Self-hosted lycorp.co.jp

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
0
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No No reward will be paid under this program for reports submitted on or after the suspension date.
Safe harbor
Full Activities conducted in accordance with these guidelines are regarded as authorized by us, unless their purpose or manner is improper, and we will not take legal action against reporters for such activities.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

0 assets you may test.

Self-hosted does not list the scope of this program publicly. Check its policy.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from LINE Security Bug Bounty's policy. "We" in these lines means the program, not this site.

While testing

  • Port scanning. Please conduct vulnerability testing only on ports 80 and 443.
  • Using automated vulnerability scanners to attack our systems
  • Performing DoS attacks or any actions that place excessive load on our services
  • Physically attacking our assets or data centers
  • Conducting social engineering (phishing, vishing, smishing, etc.)
  • Sending a vulnerability report that includes a third party’s personal data without obtaining their prior consent
  • Any activity that harms our customers, employees, partners, or the provision of our services
  • Carrying out or promoting fraudulent transactions (such as unauthorized billing or product shipment manipulation)
  • If we determine that your actions violate or may violate our Terms of Use or these guidelines, or are otherwise inappropriate, we may take necessary measures such as blocking communication or suspending accounts.

Not accepted

  • Vulnerability as-is after detection using an automated scanner
  • Hypothetical or theoretical vulnerabilities without actual verification code
  • Susceptibility to brute force attacks aimed at retrieving passwords or tokens
  • Request flooding DoS and/or any Server Side DoS attack that may lead to disruption of our service(s)
  • Cache-Poisoned Denial-of-Service
  • Ability to spam LINE users arbitrarily with spam messages
  • Ability to change a password without confirmation of the previous password on LINE app
  • Session fixation
  • Absence of Cross-Site Request Forgery (“CSRF”) token in non-critical processes
  • Login/logout CSRF
  • Attack requiring physical access to a user's device or using a rooted device
  • Missing security header(s)
  • Script executions that do not affect Users
  • Vulnerabilities attributable to out-of-date browsers or platforms
  • Content related to auto fill web forms
  • Absence of secure flag attribute for non-critical cookies
  • Unsafe SSL/TLS cipher suites or protocol version
  • Accessibility of profile photos, VOOM photos, etc. by anyone via URL
  • Vulnerability attributable to virtual phone number
  • Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
  • Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
  • Reporting that an unauthorized HTTP method can be used
  • Reporting vulnerabilities related to clickjacking, Tabjacking, Tabnabbing, Text injection, Open redirect, DNS CAA record, DNSSEC records
  • Credit card or payment platform reimbursement features
  • Overwriting of files or databases on device, or falsely showing possession of an item by altering a file along the communication pathway.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 6 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.