OOCRP
By Organized Crime and Corruption Reporting Project Vulnerability disclosure program on Self-hosted occrp.org
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 5 days
- As the policy promises.
- Public disclosure allowed
- You may publish your report.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
As a non-profit we are sadly unable to offer any compensation for disclosed security issues.
- Response
-
Within 5 days
Please allow up to 5 working days for us to contact you.
- Safe harbor
-
Partial
This program allows responsible disclosure and we will work with you if you want to publish a blogpost.
- Hall of fame
-
Yes
We would like to thank all organizations and hackers who helped us, our colleagues, and our sources stay safe and secure by responsibly disclosing security issues affecting our services.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 10 excluded.
Domains 2
- aleph.occrp.org
- occrp.org
Source code 2
- https://github.com/alephdata/aleph No bounty
- Supported versions of the Aleph open-source software published in the GitHub source code repository
Wildcard domains 2
- *.occrp.org No bounty
- occrp.org and *.occrp.org, including aleph.occrp.org
Out of scope (10)
- Attacks requiring DNS takeover
- Clickjacking without demonstration of impact
- Denial of Service vulnerabilities by using an overload of processing power or requests
- Mail relay server configuration issues
- Missing DNSSEC
- Missing/loosely configured DNS SPF records
- Missing Public Key Pinning headers
- Self-XSS
- Software version disclosure
- XSS requiring legacy browsers
Rules
What the policy asks of you, and the bug types it won't reward, quoted from OOCRP's policy. "We" in these lines means the program, not this site.
While testing
-
When you are creating an evaluation account for research purposes, please add the “bugbounty_” prefix to the username of your evaluation account.
-
If you stumble upon sensitive information, such as personal information, credentials, etc., during the assessment; do not save, copy, store, transfer, disclose, or otherwise retain the data or personal information.
-
Do not perform social engineering, phishing, and physical security attacks against offices, users, or employees.
-
Stay within the scope of the responsible disclosure program.
-
Be respectful when you are interacting with our team.
-
Please report to the address on the policy page and do not open issues on Github or other public channels.
Not accepted
-
Attacks requiring DNS takeover
-
Clickjacking without demonstration of impact
-
Denial of Service vulnerabilities by using an overload of processing power or requests
-
Mail relay server configuration issues
-
Missing/loosely configured DNS SPF records
-
Missing DNSSEC
-
Missing Public Key Pinning headers
-
Self-XSS
-
Software version disclosure
-
XSS requiring legacy browsers
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− GitHub source code repository
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.