Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Opera Public Bug Bounty

By Opera Bug bounty on Bugcrowd opera.com

Accepting reports Full safe harbor
Go to program
Top reward
$10,000
Top severity paid
Critical
Assets in scope
89
Public CVEs
60
Last change

At a glance

What to know before you start testing.

Pays up to $10,000
for critical bugs, from $50.
Report on Bugcrowd
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What Bugcrowd lists as the payout for each severity.

Severity Reward
Critical $5,000 from $1,000
High $3,000 from $300
Medium $500 from $100
Low $200 from $50
Safe harbor
Full Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Earlier reward tables (1)
  • 11 Nov 2026 to 11 Nov 2026: Critical up to $5,000

Scope

89 assets you may test, 22 excluded.

APIs 39

  • 102.23.96.0/22
  • 103.83.120.0/22
  • 107.167.96.0/19
  • 141.0.8.0/21
  • 185.26.180.0/22
  • 195.189.143.0/24
  • 203.89.100.0/22
  • 37.228.104.0/21
  • 77.111.244.0/22
  • 82.145.208.0/20
  • 91.203.96.0/22
  • api.gx.games/dc
  • api.gx.games/dev
  • api.gx.games/gms
  • api.gx.games/gx
  • api.gx.games/gxc
  • api.gx.games/profile
  • api.gx.games/pub
  • api.gx.games/session
  • api.gx.me/me
  • api.neon.opera.com/neon/pub
  • api.neon.opera.com/neon/store
  • api.neon.opera.com/pub
  • blocklist.opera-api.com
  • exchange.opera.com
  • https://accounts.opera.com
  • https://autoupdate.geo.opera.com
  • https://browser-notifications.opera.com
  • https://cdn-store.opera-api.com
  • https://cryptowallet.opera-api.com
  • https://features.opera-api.com
  • https://flow.opera.com
  • https://gx.opera-api.com
  • https://net.geo.opera.com
  • https://speeddials.opera.com
  • https://suggestions.opera-api.com
  • merchandise.opera-api.com
  • push.opera.com
  • weather.opera-api.com

Wildcard domains 20

  • *.adx.opera.com
  • *.apex-football.com
  • *.apexnews.com
  • *.apexscores.io
  • *.dailyadvent.com
  • *.feednews.com
  • *.opera.com
  • *.operafootball.com
  • *.opera-mini.net
  • *.opera.news
  • *.operanewsapp.com
  • *.opera.software
  • *.opera.technology
  • *.opr.news
  • *.osite99.com
  • *.osp.opera.software
  • *.rtbscale.com
  • *.savi.xyz
  • *.sec-tunnel.com
  • *.yoyogames.com

Web 17

  • https://auth-adx.op-mobile.opera.com
  • https://auth.opera.com
  • https://bugs.opera.com
  • https://cashback.opera.com
  • https://cms.adx.opera.com
  • https://create.gx.games
  • https://download.opera.com
  • https://get.geo.opera.com
  • https://gx.games
  • https://gx.me
  • https://neon.opera.com/cards
  • https://ofa.adx.opera.com
  • https://ofp.adx.opera.com
  • https://operaneon.com
  • https://www.gamemaker.io
  • https://www.opera.com
  • marketplace.gamemaker.io

Android apps 6

  • https://play.google.com/store/apps/details?id=com.opera.app.news
  • https://play.google.com/store/apps/details?id=com.opera.app.sports
  • https://play.google.com/store/apps/details?id=com.opera.browser
  • https://play.google.com/store/apps/details?id=com.opera.gx
  • https://play.google.com/store/apps/details?id=com.opera.mini.native
  • https://play.google.com/store/apps/details?id=com.opera.minipay

iOS apps 2

  • https://apps.apple.com/pl/app/opera-gx/id1559740799
  • https://apps.apple.com/us/app/opera-ai-browser-with-vpn/id1411869974

Products and areas 5

  • GameMaker Studio 2
  • https://www.opera.com/computer/thanks?ni=eapgx&os=windows
  • https://www.opera.com/computer/thanks?ni=opera_air&os=windows
  • https://www.opera.com/computer/thanks?ni=stable&os=windows
  • https://www.operaneon.com
Out of scope (22)
  • interstitial.opera-mini.net
  • 107.167.127.4{0,1}
  • 32s.opera.com
  • accountsstage.yoyogames.com
  • admanager.opera.com
  • bugs.yoyogames.com
  • catch.opera.com
  • certs.opera.com
  • checkout.opera.com
  • concurso.opera.com
  • contest.opera.com
  • control.gx-servers.opera.com
  • help.gx-servers.opera.com
  • help.yoyogames.com
  • investor.opera.com
  • jobs.opera.com
  • s2{1,2}-05-08-v09.opera-mini.net
  • tabfulness.opera.com
  • verizon-us-lvs-ashburn.opera-mini.net
  • verizon-us-lvs-seattle.opera-mini.net
  • verizon-us-seattle.opera-mini.net
  • wallpaper.opera.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Opera Public Bug Bounty (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.

While testing

  • Testing is only authorized on the targets listed as In-Scope.
  • Make sure the bug you found also appears in the latest publicly available build (including developer or beta versions).
  • We do not accept bug submissions for old versions of our browsers.
  • When registering for an account at Opera services for testing purposes, use your @bugcrowdninja e-mail, i.e. <bugcrowdusername>@bugcrowdninja.com.
  • Please do not use any other e-mail formats, unless testing for a specific bug that requires this.
  • Please refrain from creating an excessive amount of users and from spamming forms (order forms, contact forms, etc.) with high numbers of requests.
  • Accounts and/or IPs that violate this guideline can be blocked.
  • If you create a video PoC, please do so on a password-protected Vimeo upload and include the link in your submission.
  • Please embed screenshots into your submission rather than just simply uploading them as attachments.
  • We strongly recommend setting English locale when taking screenshots or recording videos.

Not accepted

  • Broken links on not-actively used pages.
  • Vulnerabilities affecting users of outdated browsers or platforms.
  • Presence of autocomplete attribute on web forms.
  • Missing cookie flags on non-sensitive cookies.
  • Unauthenticated/logout/login CSRF.
  • Lack of rate-limiting or automated attacks such as brute-forcing, credential stuffing, and password spraying.
  • The lack of certificate pinning.
  • Using http instead of https for requests to fetch publicly available content.
  • The presence of low-impact hardcoded secrets (for APIs).
  • The fact that there are exported Android manifest components.
  • Bugs in Chromium or Webkit, regardless of the version used by Opera.
  • Non-default Opera Add-ons (Extensions) are considered to be out-of-scope.
  • MiniApps: All vulnerabilities within individual MiniApps are strictly out of scope.
  • Intended Code Execution in Neon Make: Any Remote Code Execution (RCE) occurring within the intended, isolated sandboxed container during a Neon Make session.
  • Accessing or manipulating files/code generated within the current active session’s container by the user themselves.
  • Interactions between users' generated apps: Any vulnerabilities or interactions between separate applications published by users.
  • Model Hallucinations: The AI making up facts, URLs, or information.
  • Generating malicious code, unless you can prove it executes and causes harm.
  • Reports of model bias, "toxic" content, or poor-quality answers.
  • Denial of Service (DoS): Reports of resource exhaustion by sending many or complex prompts (unless you find a low-cost, high-impact DoS).
  • Self-Inflicted Direct Prompt Injections: These vulnerabilities occur when a user successfully designs a prompt to extract their own data.

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://neon.opera.com/cards/

  2. Scope added

    https://www.opera.com/computer/thanks?ni=opera_air&os=windows

  3. Scope added

    https://www.operaneon.com

  4. Scope added

    *.apexnews.com

  5. Scope added

    https://play.google.com/store/apps/details?id=com.opera.minipay

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2018-16135 Medium 6.5 26 Dec 2022
CVE-2021-23253 Medium 5.3 11 Jan 2021
CVE-2020-6159 Medium 6.1 23 Dec 2020
CVE-2020-6157 Medium 4.3 13 Nov 2020
CVE-2019-12278 Medium 4.3 12 Mar 2020
CVE-2019-19788 Medium 5.5 18 Dec 2019
CVE-2019-18624 Critical 9.8 29 Oct 2019
CVE-2019-13607 Medium 6.1 18 Jul 2019
CVE-2018-18913 High 7.8 21 Mar 2019
CVE-2018-6608 Medium 4.3 28 Mar 2018
CVE-2016-4075 Medium 6.1 21 Apr 2017
CVE-2016-6908 Medium 6.1 26 Jan 2017
CVE-2015-8960 High 8.1 21 Sep 2016
CVE-2016-7153 Medium 5.3 6 Sep 2016
CVE-2016-7152 Medium 5.3 6 Sep 2016
CVE-2016-5101 High 8.8 29 Jun 2016
CVE-2015-4000 Low 3.7 21 May 2015
CVE-2014-1870 Medium 4.3 6 Feb 2014
CVE-2014-0815 Medium 4.3 6 Feb 2014
CVE-2013-4705 Medium 4.3 13 Sep 2013
CVE-2013-3210 Medium 5.0 19 Apr 2013
CVE-2013-3211 High 10.0 19 Apr 2013
CVE-2013-1618 Medium 4.0 8 Feb 2013
CVE-2013-1639 Medium 6.8 8 Feb 2013
CVE-2013-1637 High 9.3 8 Feb 2013
CVE-2013-1638 High 9.3 8 Feb 2013
CVE-2013-1489 High 10.0 31 Jan 2013
CVE-2012-6470 High 9.3 2 Jan 2013
CVE-2012-6460 Medium 5.0 2 Jan 2013
CVE-2012-6461 Medium 5.0 2 Jan 2013
CVE-2012-6462 Medium 5.0 2 Jan 2013
CVE-2012-6463 Medium 4.3 2 Jan 2013
CVE-2012-6464 Medium 4.3 2 Jan 2013
CVE-2012-6465 High 9.3 2 Jan 2013
CVE-2012-6466 Medium 5.0 2 Jan 2013
CVE-2012-6467 Medium 4.3 2 Jan 2013
CVE-2012-6468 High 9.3 2 Jan 2013
CVE-2012-6469 Medium 5.0 2 Jan 2013
CVE-2012-6471 Medium 5.0 2 Jan 2013
CVE-2012-6472 Medium 4.6 2 Jan 2013
CVE-2012-5180 Medium 4.3 26 Dec 2012
CVE-2010-5227 Medium 6.9 7 Sep 2012
CVE-2012-4010 Medium 5.0 30 Aug 2012
CVE-2012-4146 Medium 4.3 6 Aug 2012
CVE-2012-4145 High 10.0 6 Aug 2012
CVE-2012-4144 Medium 4.3 6 Aug 2012
CVE-2012-4143 Medium 6.8 6 Aug 2012
CVE-2012-4142 Medium 4.3 6 Aug 2012
CVE-2012-3560 Medium 4.3 14 Jun 2012
CVE-2012-3561 High 10.0 14 Jun 2012
CVE-2012-3568 Medium 5.0 14 Jun 2012
CVE-2012-3567 Medium 5.0 14 Jun 2012
CVE-2012-3566 Medium 4.3 14 Jun 2012
CVE-2012-3565 Medium 5.0 14 Jun 2012
CVE-2012-3564 Medium 5.0 14 Jun 2012
CVE-2012-3563 Medium 5.0 14 Jun 2012
CVE-2012-3562 Medium 4.3 14 Jun 2012
CVE-2012-3558 Low 2.6 14 Jun 2012
CVE-2012-3559 High 10.0 14 Jun 2012
CVE-2012-3557 Medium 5.0 14 Jun 2012

Original policy

Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

Here at Opera, we are excited to work with the security community to secure our products and services. Before reporting a vulnerability, please make sure you review the following program rules. Good luck, and happy hunting! Rewards: A demonstrated security impact described in the ticket by the reporter and then confirmed by Opera is the key factor that drives bounty range. We expect the reporter to provide a realistic attack scenario, evaluate the impact and honestly report it. The more potential damage we were saved from by disclosing a vulnerability, the higher the payout. Some examples of high-impact vulnerabilities: Confirmed impact │ Bounty [USD] A demonstrated leak of end-user personal data from production servers at scale (database or file storage dump, or ability to harvest data systematically). │ 5-10K Ability to deface or modify a key Opera production website (e.g. www.opera.com). │ 5-10K Break a significant “security requirement” [1] of any Opera’s product. │ 2-10K A demonstrated scenario to take administrative control over core infrastructure in production (network devices, hardware, hypervisors). │ 5-10K A demonstrated scenario to take administrative control over web application panels in production. │ 1-5K Anything less impactful. │ < 1K No impact was demonstrated in the submission. │ 0 [1] Examples of what constitutes breaking a significant security requirement: Use Opera paid services or premium features for free. Hijack end-user valuable assets (account balances, earnings, artifacts). Theft of arbitrary files from the local system. Opera Account takeover without any social engineering. Disclosure of secrets (e.g. messages in Flow). SSL integrity checks bypass. Vertical privilege escalation. 0-click disclosure of browsing history. Achieving native code execution. Memory corruption leading to a limited or arbitrary memory read or write. JavaScript injection into browser UI or other origins. Please note that in terms of the quality of your report, we will be looking at the following points: The issue description is clear and understandable. The issue is a vulnerability, not simply a security risk or missing best practice. The target and attack method is in-scope as per our program’s brief. A realistic, repeatable, and unconditional attack scenario is provided. A real security impact is honestly reported. Reproduction steps, proof of concept, or exploit is submitted and it works. To qualify for any monetary reward, all of those requirements have to be met . Video PoC & Screenshots If you create a video PoC, please do so on a password-protected Vimeo upload and include the link in your submission. Please embed screenshots into your submission rather than just simply uploading them as attachments. We strongly recommend setting English locale when taking screenshots or recording videos.

Targets

Testing is only authorized on the targets listed as In-Scope. Before reporting vulnerabilities in browsers it is recommended to read the security section of the Chromium project and its FAQ . Points that are most often missed by researchers are about local attacks and malicious software . Make sure the bug you found also appears in the latest publicly available build (including developer or beta versions). We do not accept bug submissions for old versions of our browsers. Target Information Credentials When registering for an account at Opera services for testing purposes, use your @bugcrowdninja e-mail, i.e. @bugcrowdninja.com. Please do not use any other e-mail formats, unless testing for a specific bug that requires this. You can also use alias emails when multiple accounts are required for testing, i.e. [email protected]. Please refrain from creating an excessive amount of users and from spamming forms (order forms, contact forms, etc.) with high numbers of requests. Accounts and/or IPs that violate this guideline can be blocked. Out of scope vulnerabilities The following issues and attack methods are considered out of scope: Open redirect issues without​​ demonstrable security impact. Broken links on not-actively used pages. Vulnerabilities affecting users of outdated browsers or platforms. Presence of autocomplete attribute on web forms. Missing cookie flags on non-sensitive cookies. Unauthenticated/logout/login CSRF. Lack of rate-limiting or automated attacks such as brute-forcing, credential stuffing, and password spraying. Exceptional cases can be considered on a case-by-case basis at Opera’s discretion. Opera browsers Please note that the vulnerabilities below are considered as out-of-scope: The lack of certificate pinning. While certificate pinning is used for some more important connections, the lack of certificate pinning, in general, is not considered a security vulnerability. Using http instead of https for requests to fetch publicly available content. We strive to use https when possible, but in some cases, http may be used for non-sensitive requests. Letting us know that http is used will not be accepted as a valid submission unless it can be demonstrated that the browser forces sending sensitive information over http. The presence of low-impact hardcoded secrets (for APIs). The browser communicates with certain services that require the usage of API keys. It is not considered a vulnerability that these API keys are hardcoded in the application. For an issue to be valid, it must be demonstrated that the API key can be used to, for example, access private or sensitive data. The fact that there are exported Android manifest components. Opera for Android and Opera Mini include manifest components that must be exported for the product to work as intended. Issues related to these components must demonstrate a clear security impact to be considered valid. Bugs in Chromium or Webkit, regardless of the version used by Opera. Non-default Opera Add-ons (Extensions) are considered to be out-of-scope. Opera Android Apps Please note that the bugs found in our Android apps could be reported to the Google Play Security Rewards Program. Opera MiniPay Please note the following scope exclusions for the MiniPay: MiniApps: All vulnerabilities within individual MiniApps are strictly out of scope. Partner Integrations: MiniPay integrates with numerous external partners and services. Vulnerabilities residing in a partner's infrastructure, APIs, or smart contracts - rather than Opera's own implementation - are out of scope. Please report these directly to the respective third party. AI Product Security Vulnerabilities This portion of our bug bounty program covers Opera AI and Opera Neon Browser. In-Scope Vulnerabilities Except standard application vulnerabilities, we are primarily interested in the following types of AI-Specific security vulnerabilities: Data Exfiltration: Prompt injection or manipulation vulnerabilities that result in the exposure of sensitive, non-public data (excluding the current user's data) are in scope. This includes, but is not limited to, other users' Personally Identifiable Information (PII) or conversation histories, internal server code and secrets. Cross-User Attacks & Privilege Escalation: Vulnerabilities where one user can manipulate the AI's state or output to affect another user's session. Bypassing user-level permissions (e.g., an unauthorized user accessing another's chat history). Insecure Output Handling: Using the AI to execute privileged browser actions without user consent (e.g., unauthorized navigation, reading local files, manipulating browser’s security settings). Server-Side Vulnerabilities via AI Input: Using the AI interface to trigger backend vulnerabilities like Server-Side Request Forgery (SSRF), Remote Code Execution (RCE), or SQL Injection in the systems processing the AI requests. Container escape. Indirect Prompt Injection: Hidden prompt from an untrusted source (e.g., webpage, document, image) causes the AI to perform malicious actions when given a simple, unrelated task (e.g., "summarize this page”). This is in-scope if it leads to data exfiltration or unauthorized, dangerous actions without Human-in-the-loop mechanism. Out of Scope To help you focus your research on security-impactful bugs, the following are explicitly out of scope for this program: Intended Code Execution in Neon Make: Any Remote Code Execution (RCE) occurring within the intended, isolated sandboxed container during a Neon Make session. Internet Access from Make Containers: The ability for a Neon Make container to reach the public internet, unless it can be used to bypass rate limits or perform large-scale DDoS attacks. Accessing or manipulating files/code generated within the current active session’s container by the user themselves. Interactions between users' generated apps: Any vulnerabilities or interactions between separate applications published by users. Model Hallucinations: The AI making up facts, URLs, or information. Simple Jailbreaks & Safety Bypasses: Getting the model to say "bad words," express opinions, or discuss sensitive topics without a clear security impact on another user or the platform. Generating malicious code, unless you can prove it executes and causes harm. Reports of model bias, "toxic" content, or poor-quality answers. Denial of Service (DoS): Reports of resource exhaustion by sending many or complex prompts (unless you find a low-cost, high-impact DoS). Self-Inflicted Direct Prompt Injections: These vulnerabilities occur when a user successfully designs a prompt to extract their own data. Phishing/Social Engineering: Getting the model to write a phishing email. (This would be in-scope only if the AI sends the email or creates a convincing phishing page on our domain). System Prompt Leaking: Reports that disclose the AI's system prompt, pre-prompt, or base instructions. This is out of scope unless you can use this knowledge to demonstrate a separate, high-impact vulnerability (like data exfiltration or privilege escalation) that was not possible without it. Third-party bugs Opera utilizes various 3rd-party applications and software in some of its platforms. While Opera considers software bugs in these 3rd-party applications to be out of scope, we are interested in issues around misconfiguration and usage of these applications. If the issue is something that can be fixed by the Opera team, then it may be considered a valid issue that is rewardable. Note, however, that payment for such cases will be decided on a case-to-case basis, based on general rewarding philosophy, and in general shouldn't be expected. If the issue is a bug that is managed by the 3rd-party software vendor, it will be marked as Not Applicable. Please also note that when Chromium or Webkit is used in a product, it is considered a third-party component. Bugs in Chromium and Webkit are unconditionally not rewardable. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.