Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Rootly

Vulnerability disclosure program on Self-hosted rootly.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
13
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 5 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Response
Within 5 days Real vulnerabilities acknowledged within 5 business days.
Safe harbor
Full If you make a good-faith effort to follow this policy, Rootly will not pursue or support legal action against you for your research.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

13 assets you may test, 3 excluded.

Domains 5

  • api.rootly.com
  • mobile-api.rootly.com
  • rootly.com
  • rootly.com and its production subdomains
  • slack.rootly.com

Android apps 1

  • Rootly mobile apps (Android and iOS)

APIs 1

  • API

Products and areas 6

  • MCP server
  • mobile apps (Android + iOS)
  • Rootly MCP server
  • Rootly Slack and Teams apps
  • Rootly web app
  • Slack and Teams apps
Out of scope (3)
  • Findings that require already-compromised credentials, rooted devices, or physical access
  • Staff social accounts and personal devices
  • Third-party services we integrate with

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Rootly's policy. "We" in these lines means the program, not this site.

While testing

  • Stay within the law. Use your own test accounts wherever possible.
  • Use the smallest proof of concept that demonstrates the issue, don't exploit it.
  • If you incidentally access it, stop immediately, report it, and securely delete it within 30 days of resolution (or sooner if legally required).
  • Keep details between you and [email protected] .
  • Run high-intensity scanners, fuzzers, or load tests against production systems.
  • Attempt denial of service, resource exhaustion, or anything that could page our on-call team.
  • Modify, delete, or exfiltrate data belonging to Rootly or our customers.
  • Social engineer, phish, or physically target Rootly staff, vendors, or offices.
  • Demand payment in exchange for disclosure.

Not accepted

  • missing security headers
  • TLS cipher preferences
  • SPF/DMARC nits
  • version disclosure
  • clickjacking on unauthenticated pages
  • purely informational findings

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.