Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Parity Technologies

Bug bounty on Self-hosted parity.io

Accepting reports Full safe harbor KYC to get paid
Go to program Website
Top reward
Not published
Top severity paid
Not published
Assets in scope
12
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays cash
Amounts are not published; ask before you invest time.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Payment
Proof of identity needed to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash
Yes We will pay bounties for vulnerabilities in third-party libraries (for instance, libp2p) incorporated into shipped client code utilized by Parity if both of the following two conditions are met:
Safe harbor
Full If you conduct genuine, in-scope, bug-hunting research in good faith and in accordance with this policy, we will consider your actions to be legitimate and will not seek prosecution.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

12 assets you may test, 4 excluded.

Source code 8

  • https://github.com/paritytech/polkadot-sdk
  • https://github.com/polkadot-fellows/runtimes
  • https://github.com/polkadot-js/apps
  • https://github.com/polkadot-js/common
  • https://github.com/polkadot-js/extension
  • Polkadot-JS: only apps , extensions , and common repositories
  • Polkadot SDK
  • Runtimes

Domains 2

  • parity.io
  • polkadot.network

Products and areas 2

  • Parity Releases Pipeline
  • Production infrastructure
Out of scope (4)
  • Bugs in third-party tools and services we're using (but we would be glad to connect you with the security team of the corresponding project).
  • Codebases included in other Bug Bounty programs, for e.g. Snowbridge, Hyperbridge, Parachains, etc...
  • Projects like Frontier, Polkadot API (PAPI), Novasama Wallets, and ink!.
  • Static or dynamic websites (hosted behind parity.io, polkadot.network, and Polkadot SDK.io (sub)domains, etc.), until you can find a way to compromise the data on the website for all of the visitors.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Parity Technologies's policy. "We" in these lines means the program, not this site.

While testing

  • Use your best effort not to access, modify, delete, or store user data or Parity's data. Instead, use your own accounts or test accounts for security research purposes.
  • Don't defraud, harm, or violate the privacy of Parity Technologies, Polkadot, or its users during your research; you should make a good faith effort not to interrupt or degrade on-chain services.
  • Don't target our physical security measures or attempt to use social engineering, spam, or distributed denial-of-service (DDoS) attacks.
  • Initially, report the bug only to us and not to anyone else. Keep the details of any suspected bug confidential.
  • After reporting a suspected bug, give us a reasonable amount of time to fix it before disclosing it to anyone else, and seek our approval before doing so.
  • Don't make repeat submissions of low-quality, rejected, or automated vulnerability reports.
  • In exceptional circumstances, we may ask you to assist us in protecting the ecosystem by signing an NDA regarding the discovered vulnerability.
  • Please provide us with a working proof-of-concept or equivalent evidence, assuming that your research didn't produce unrecoverable changes.
  • Please do not break our (or anyone else's) stuff. If you suspect that the bug you have found may be fatal for what you are testing against, please DO NOT take further actions.
  • If you are able to compromise something significant, please STOP at the point of recognition, collect enough small evidence to understand where you are and what you can do, and report the vulnerability to us.

Not accepted

  • Codebases included in other Bug Bounty programs, for e.g. Snowbridge, Hyperbridge, Parachains, etc...
  • Projects like Frontier, Polkadot API (PAPI), Novasama Wallets, and ink!.
  • Bugs that have already been submitted by another reporter, are already known to the Parity team, or have already been publicly disclosed.
  • Bugs in third-party tools and services we're using (but we would be glad to connect you with the security team of the corresponding project).
  • Social engineering attacks are also excluded.
  • Anything that contravenes the spirit or letter of this program.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 6 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.