Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Phabricator

Bug bounty on HackerOne phacility.com

Accepting reports
Go to program Website
Top reward
Not published
Top severity paid
Not published
Assets in scope
3
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays cash
Amounts are not published; ask before you invest time.
Report on HackerOne
Submit through the program page.
Paid by electronic
No identity requirement stated.
Public disclosure allowed
You may publish your report.

Rewards

What HackerOne lists as the payout for each severity.

HackerOne does not publish a reward table for this program.

Top reward
$3,000 Bounty Range: ~$300 - $3,000, based on severity.
Lowest reward
$300 Bounty Range: ~$300 - $3,000, based on severity.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

3 assets you may test, 4 excluded.

Source code 3

  • Arcanist
  • externals/
  • Phabricator
Out of scope (4)
  • phabricator.com
  • phabricator.org
  • secure.phabricator.com
  • any other existing install you might find

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Phabricator (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Do not test an install of Phabricator that you do not own.
  • Instead, install a local copy of Phabricator.
  • Do not report configuration issues with `phabricator.org`, `phabricator.com`, etc.
  • please include the word "mongoose" somewhere in your report.
  • Responsibly disclose a previously unknown vulnerability directly to us.
  • Report vulnerabilities only if you are comfortable with full disclosure once the report is closed.

Not accepted

  • SERVER CONFIGURATION ISSUES DO NOT QUALIFY
  • software versions, SPF headers, etc.
  • Denial of Service and Social Engineering attacks are unlikely to qualify unless particularly clever.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 18 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Security is serious business, just like Phabricator. If you can find a security vulnerability in the project, we’ll reward you with cold, hard cash. The cash will be transmitted electronically, so it will be cold and hard only figuratively.

READ THIS

  • IMPORTANT: DO NOT TEST secure.phabricator.com. Do not test an install of Phabricator that you do not own. This includes secure.phabricator.com and any other existing install you might find. If you report an issue against secure.phabricator.com or another install you do not own, it will not be accepted. Instead, install a local copy of Phabricator. This will let you test Phabricator without disrupting other users.
  • IMPORTANT: SERVER CONFIGURATION ISSUES DO NOT QUALIFY. Do not report configuration issues with phabricator.org, phabricator.com, etc. For example: software versions, SPF headers, etc. These are outside of program scope. The goal of this program is to find vulnerabilities in the Phabricator software itself.
  • For instructions on installing a local copy of Phabricator, see the Installation Guide.
  • We receive many reports (significantly more than 50%) from researchers who do not read these rules. To prove that you've read and understood these rules, please include the word "mongoose" somewhere in your report. If you do not, your report will be closed as "Not Applicable".

The Fine Print

  • Responsibly disclose a previously unknown vulnerability directly to us.
  • This vulnerability must significantly compromise the security of a typical Phabricator installation.
  • Denial of Service and Social Engineering attacks are unlikely to qualify unless particularly clever.
  • Vulnerabilities in Phabricator and Arcanist are in scope.
  • Vulnerabilities in other bundled dependencies (in externals/ directories) qualify if they affect a typical Phabricator installation, but are less interesting than vulnerabilities in Phabricator itself.
  • Report vulnerabilities only if you are comfortable with full disclosure once the report is closed.

Getting Started

  • You can find the source and start looking for vulnerabilities on GitHub.
  • Phabricator has more than 300,000 lines of PHP, so there are probably at least sixty or seventy million security vulnerabilities in the project. Virtually limitless wealth!

Response Timeline / End of Life

  • Effective June 1, 2021: Phabricator is no longer actively maintained. This program is still monitored, but can no longer offer a specific response timeline.

Bounty Range: ~$300 - $3,000, based on severity.