Linear

Bug bounty on Self-hosted linear.app

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash: Yes We offer financial compensation for valid vulnerabilities.
Safe harbor: Full Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

15 assets you may test, 10 excluded.

Out of scope (10)

Attacks requiring physical access to the victim’s computer
Automated scanning of any kind
Clickjacking on pages with no sensitive actions
Denial of Service attacks of any kind
High-privilege users (admins, owners) using a bug to sabotage/deface their own workspace
Logic bugs which allow an attacker to bypass limits on free accounts and get access to features on paid plans.
Man-in-the-middle attacks
Social engineering of any kind, in particular Linear employees
Theoretical attacks without proof of exploitability
https://github.com/linear

What the policy asks of you, and the bug types it won't reward, quoted from Linear's policy. "We" in these lines means the program, not this site.

Only test the vulnerability on your own account or with explicit permission from the account holder.
Make a good faith effort to avoid privacy violations, copying or destruction of data, and interruption or degradation of our service.
If you obtain remote access to our systems, do not attempt to expand or elevate access to other servers.
To prevent further exploitation, please do not make the vulnerability public before reporting it to us, and give us adequate time to address the issue.

Missing best practices in HTTP headers (CSP, etc), HTTP cookies, TLS versions / ciphersuites, and DNS configuration
Defense-in-depth hardening items, not vulnerabilities
Permissive CORS configuration on public API
GraphQL introspection enabled on public API
Pre-auth login metadata exposed by the public API (auth methods, region, SSO URL)
Open Dynamic Client Registration on the MCP server (mcp.linear.app), including unauthenticated registration and arbitrary redirect URIs
Assumed SSRF to internal or metadata targets in GraphQL mutations that fetch a user-supplied URL or hostname server-side
Findings in our public repositories (https://github.com/linear), such as dependency advisories, scanner output, or issues in sample and example code

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake