Ruby on Rails
Vulnerability disclosure program on HackerOne rubyonrails.org
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report through their form
- hackerone.com/rails
- Full safe harbor
- Good-faith research is authorised; no legal action.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
Yes
you have our thanks and might be eligible for a cash reward.
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 1 excluded.
Source code 1
- https://github.com/rails/rails Critical No bounty
Out of scope (1)
- *.rubyonrails.org
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Ruby on Rails (via HackerOne)'s policy.
Not accepted
-
Regular expression denial of service attacks (ReDOS)
-
Obviously unsafe sanitizer configurations, such as allowing a default-disallowed tag and/or attribute that is documented to allow javascript
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Rails is used to power some of the most important sites on the web and its increasing popularity has made it a critical piece of internet infrastructure. If you've found a security bug that could potentially impact the security of these sites, you have our thanks and might be eligible for a cash reward.
General eligibility
The scope of the Rails project's HackerOne program is limited to the source code under https://github.com/rails. Please take a look at our scope page.
Out of scope
Some types of issues are out of scope, and may be closed as N/A if a report is opened:
- Regular expression denial of service attacks (ReDOS)
- Ruby 3.2's Regexp.timeout allows Rails to mitigate these types of attacks.
- Obviously unsafe sanitizer configurations, such as allowing a default-disallowed tag and/or attribute that is documented to allow javascript
- Out-of-scope tags include (but are not limited to)
iframe,embed,frame,frameset, andform. - Out-of-scope attributes include (but are not limited to)
onload,animate,onfocus, andsrcdoc. - Complex combinations of disallowed tags and attributes may be eligible but will be evaluated on a case-by-case basis and will be closed if we deem the combination to be unlikely or obviously insecure.
- Out-of-scope tags include (but are not limited to)
In addition, HackerOne's Core Ineligible Findings are out of scope and will be closed as N/A.
Bounty Qualification
As of March 27, 2026 the Internet Bug Bounty (IBB) is no longer accepting new submissions. This means that any vulnerabilities submitted from that date forward are not eligible for a bounty.
You can learn more about how to contribute to Ruby on Rails here.
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.