Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

NEOGOV Public Assets

By NEOGOV Bug bounty on Bugcrowd neogov.com

Accepting reports Full safe harbor
Go to program
Top reward
$3,500
Top severity paid
Critical
Assets in scope
17
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $3,500
for critical bugs, from $100.
Report on Bugcrowd
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What Bugcrowd lists as the payout for each severity.

Severity Reward
Critical $3,500
High $1,200
Medium $300
Low $100
Safe harbor
Full Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Earlier reward tables (1)
  • 11 Nov 2026 to 11 Nov 2026: Critical up to $3,500

Scope

17 assets you may test.

Web 17

  • https://analytics.neogov.com
  • https://api.neogov.com
  • https://app.agency360.com
  • https://cdn.neogov.com
  • https://eforms.neogov.com
  • https://hr.neogov.com
  • https://learn.neogov.com
  • https://login.neogov.com
  • https://onboard.neogov.com
  • https://performance.neogov.com
  • https://powerdms.com
  • https://secure.cuehit.net
  • https://secure.neogov.com
  • https://securesignin.neogov.com
  • https://securesignin.powerdms.com
  • https://unified.neogov.com
  • https://www.governmentjobs.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from NEOGOV Public Assets (via Bugcrowd)'s policy.

While testing

  • International researchers (outside the USA) will not be able to access the aforementioned targets (due to a geofence), and will need to use a VPN to access the applications.
  • You are expected, as always, to comply with all applicable laws.
  • If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.

Not accepted

  • Simultaneous Sessions Allowed
  • Cross-Frame Scripting (XFS) and Clickjacking
  • Secure Flag Not Set
  • Reflective Cross-Site Scripting (XSS)
  • Sensitive Data Passed in URL
  • Page Caching Enabled
  • Previous Passwords not Disallowed
  • OCSP Stapling not Configured
  • Content Sniffing not Disabled
  • Missing Cross-Site Scripting Protection Headers
  • Character Encoding not Specified for All Input Sources
  • Rate limiting submissions will be marked at Won't Fix

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 54 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://hr.neogov.com

  2. Scope added

    https://securesignin.powerdms.com/

  3. Scope added

    https://securesignin.neogov.com

  4. Scope added

    https://app.agency360.com

  5. Scope added

    https://secure.cuehit.net

  6. Scope added

    https://powerdms.com/

  7. Scope added

    https://analytics.neogov.com

  8. Scope added

    https://www.governmentjobs.com

  9. Scope added

    https://cdn.neogov.com

  10. Scope added

    https://eforms.neogov.com

  11. Scope added

    https://unified.neogov.com

  12. Scope added

    https://onboard.neogov.com

  13. Scope added

    https://api.neogov.com

  14. Scope added

    https://learn.neogov.com

  15. Scope added

    https://performance.neogov.com

  16. Scope added

    https://login.neogov.com

  17. Scope added

    https://secure.neogov.com

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

Welcome to the NEOGOV Public Assets Bug Bounty program! No technology is perfect, and NEOGOV believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Any domain/property of NEOGOV not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Access International researchers (outside the USA) will not be able to access the aforementioned targets (due to a geofence), and will need to use a VPN to access the applications. Focus Areas Expose any vulnerabilities on login.neogov.com Obtain user data from another agency - neogov2 (agency.governmentjobs.com/neogov2) Obtain a resume or profile information from www.governmentjobs.com for another user Out of Scope Simultaneous Sessions Allowed Cross-Frame Scripting (XFS) and Clickjacking Secure Flag Not Set Reflective Cross-Site Scripting (XSS) Sensitive Data Passed in URL Page Caching Enabled Previous Passwords not Disallowed OCSP Stapling not Configured Content Sniffing not Disabled Missing Cross-Site Scripting Protection Headers Character Encoding not Specified for All Input Sources Rate limiting submissions will be marked at Won't Fix Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.

In Scope (in scope)

The websites listed below are publicly available within the United States. All websites share common database servers. We will not provide a login for the following sites: login.neogov.com www.governmentjobs.com (job search/apply, self-register) api.neogov.com (api's, no login required) cdn.neogov.com (content delivery, no login required) www.governmentjobs.com/careers/* (agency job postings, no login required)