Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Recorded Future Public Managed Bug Bounty Engagement

By Recorded Future Bug bounty on Bugcrowd recordedfuture.com

Accepting reports Full safe harbor
Go to program
Top reward
$5,000
Top severity paid
Critical
Assets in scope
20
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $5,000
for critical bugs, from $250.
Report on Bugcrowd
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What Bugcrowd lists as the payout for each severity.

Severity Reward
Critical $5,000
High $2,000
Medium $750
Low $250
Earlier reward tables (1)
  • 11 Nov 2026 to 11 Nov 2026: Critical up to $5,000

Scope

20 assets you may test.

Web 12

  • https://app.recordedfuture.com
  • https://geminiadvisory.io
  • https://hatching.io
  • https://id.recordedfuture.com
  • https://portal.riskrecon.com
  • https://portal.riskrecon.eu
  • https://securitytrails.com
  • https://tria.ge
  • https://vendor.riskrecon.com
  • https://vendor.riskrecon.eu
  • https://www.recordedfuture.com
  • https://www.riskrecon.com

APIs 6

  • https://api.recordedfuture.com
  • https://api.riskrecon.com
  • https://api.riskrecon.eu
  • https://auth.riskrecon.com
  • https://auth.riskrecon.eu
  • https://mcp.recordedfuture.com

Android apps 1

  • https://play.google.com/store/apps/details?id=com.recordedfuture.mobile&hl=en_US

iOS apps 1

  • https://apps.apple.com/us/app/recorded-future/id1435597894

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Recorded Future Public Managed Bug Bounty Engagement (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.

While testing

  • Testing is only authorized on the targets listed as In-Scope.
  • When registering for an account, please sign up for an account using your @bugcrowdninja.com email address.

Not accepted

  • Clickjacking on pages with no sensitive actions
  • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
  • Attacks requiring MITM or physical access to a user's device.
  • Previously known vulnerable libraries without a working Proof of Concept.
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability.
  • Missing best practices in SSL/TLS configuration.
  • Any activity that could lead to the disruption of our service (DoS).
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
  • Rate limiting or bruteforce issues on non-authentication endpoints
  • Missing best practices in Content Security Policy.
  • Missing HttpOnly or Secure flags on cookies
  • Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
  • Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
  • Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
  • Tabnabbing
  • Open redirect - unless an additional security impact can be demonstrated
  • Issues that require unlikely user interaction (e.g: Broken link hijacking leading to external resources )
  • Lists with leaked credentials
  • IDOR issues and similar regarding submitted samples and reports for the free tier.

Summarised with AI from the program policy on Bugcrowd, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://www.riskrecon.com

  2. Scope added

    https://mcp.recordedfuture.com

  3. Scope added

    https://portal.riskrecon.eu

  4. Scope added

    https://portal.riskrecon.com

  5. Scope added

    https://auth.riskrecon.eu

  6. Scope added

    https://auth.riskrecon.com

  7. Scope added

    https://api.riskrecon.eu

  8. Scope added

    https://api.riskrecon.com

  9. Scope added

    https://vendor.riskrecon.eu

  10. Scope added

    https://vendor.riskrecon.com

  11. Scope added

    https://www.recordedfuture.com

  12. Scope added

    https://securitytrails.com

  13. Scope added

    https://play.google.com/store/apps/details?id=com.recordedfuture.mobile&hl=en_US

  14. Scope added

    https://apps.apple.com/us/app/recorded-future/id1435597894

  15. Scope added

    https://api.recordedfuture.com

  16. Scope added

    https://app.recordedfuture.com

  17. Scope added

    https://geminiadvisory.io

  18. Scope added

    https://hatching.io

  19. Scope added

    https://id.recordedfuture.com

  20. Scope added

    https://tria.ge

  21. Scope removed

    https://bgpview.io

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

Welcome to the Recorded Future Bug Bounty program! No technology is perfect, and Recorded Future believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Recorded Future not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Recorded Future, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation. Credentials: Credentials will not be provided for this engagement, however where accounts can be self-provisioned. When registering for an account, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Out of Scope When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope: Clickjacking on pages with no sensitive actions Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions Attacks requiring MITM or physical access to a user's device. Previously known vulnerable libraries without a working Proof of Concept. Comma Separated Values (CSV) injection without demonstrating a vulnerability. Missing best practices in SSL/TLS configuration. Any activity that could lead to the disruption of our service (DoS). Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS Rate limiting or bruteforce issues on non-authentication endpoints Missing best practices in Content Security Policy. Missing HttpOnly or Secure flags on cookies Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.) Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version] Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors). Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis. Tabnabbing Open redirect - unless an additional security impact can be demonstrated Issues that require unlikely user interaction (e.g: Broken link hijacking leading to external resources ) Lists with leaked credentials Specific Out-of-scope for tria.ge IDOR issues and similar regarding submitted samples and reports for the free tier.