OpenProject
Vulnerability disclosure program on security.txt openproject.org
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Please note that OpenProject does not currently offer its own bug bounty program.
- Safe harbor
-
Partial
Only test your own instances : Targeting other users’ instances is forbidden. Only test against your own OpenProject installation.
- Hall of fame
-
Yes
We will gladly reference your work, name, and website on every publication we make related to the security update.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 1 excluded.
Domains 2
- openproject.com
- openproject.org
Products and areas 1
- your own OpenProject installation
Out of scope (1)
- other users’ instances
Rules
What the policy asks of you, and the bug types it won't reward, quoted from OpenProject's policy. "We" in these lines means the program, not this site.
While testing
-
Only test your own instances : Targeting other users’ instances is forbidden.
-
No public disclosure without agreement : No vulnerability disclosure, full, partial, or otherwise, is allowed without prior agreement from us.
-
Redact sensitive data : Do not include Personally Identifiable Information (PII) in your report.
-
Human interaction required: Please do not report unchecked and obvious AI-generated reports, or we may have to close them without further comments.
Not accepted
-
Outdated versions of OpenProject.
-
Tab nabbing
-
Content/text injections that do not result in an XSS attack due to other mitigations
-
Denial of service attacks through memory exhaustion, content size, or similar measures
-
Race conditions for business logic constraints (e.g., duplicating unique names through timing attacks) without further impact
-
HTML injection in formattable content (e.g., links, images) that duplicates what Markdown already allows.
-
Clickjacking / UI redressing due to inline CSS styles being allowed in certain formattable places.
-
Recently disclosed CVEs (less than 30 days since patch release) for third party libraries
-
Presence of autocomplete attribute on web forms
-
Vulnerabilities affecting outdated browsers or platforms
-
Hypothetical flaws or best practice recommendation without an exploitable vulnerability and proof of concept
-
Reports with attack scenarios requiring MITM or physical access to the victim’s device
-
Blind SSRF without exploitable vulnerabilities and proof of concept (e.g., DNS and HTTP pingback)
-
Ability to spam users (email, SMS, or direct message flooding)
-
Exploits that rely on a voluntarily downgraded configuration, or on not-recommended security settings
-
Stolen secrets, credentials, or information gathered from a third-party asset outside our control
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.