Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

OurFabriq

By Fabriq Vulnerability disclosure program on Self-hosted ourfabriq.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
0
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No We do not currently offer cash compensation for security reports.
Safe harbor
Full We will not pursue any legal action against you, if you obey the rules above.
Hall of fame
Yes For eligible reports, we can acknowledge your work by putting your name and (optionally) a link to your personal page on the list of security contributors below.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

0 assets you may test.

Self-hosted does not list the scope of this program publicly. Check its policy.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from OurFabriq's policy. "We" in these lines means the program, not this site.

While testing

  • Avoid data deletion, unauthorized data access, and service disruption while testing the vulnerability you found.
  • Do not access or modify, or attempt to access or modify, data that does not belong to you.
  • Do not execute, or attempt to execute, a Denial of Service (DoS) attack.
  • Do not run any automated tools against our servers without prior coordination.
  • Do not try to abuse our servers’ resources, including but not limited to sending unsolicited or unauthorized email.
  • Do not publicly share the issue details until we confirm that it’s fixed.
  • Do not attempt to blackmail us, or try to sell us your security report.

Not accepted

  • Vulnerabilities to timing and DOS attacks (remember, you’re not allowed to test these).
  • Vulnerabilities that have been previously reported by another user.
  • Known vulnerabilities in the components of our technological stack reported within 48 hours since their public reveal.
  • Bugs or functionality that proves that a tested email address exists in our database as well as the theoretical ability to brute-force such functionality.
  • Any and all WordPress only vulnerabilities.
  • Ability to sign up and use our services without confirming an email address.
  • Lack of CAPTCHAs on the forms.
  • Lack of use of hardfail (-all) on SPF records.
  • Lack of a “reject” record in DMARC.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.