- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 7
- Public CVEs
- 8
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs.
- Report on HackenProof
- Submit through the program page.
Rewards
What HackenProof lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
Scope
7 assets you may test, 4 excluded.
Domains 2
- status.app/api/download/linux No bounty
- status.app/api/download/windows No bounty
Wildcard domains 2
- *.status.app No bounty
- *.status.im No bounty
Android apps 1
- https://status-im-files.ams3.cdn.digitaloceanspaces.com/StatusIm-Mobile-v1.19.0-d6a6c4.apk No bounty
Smart contracts 1
- Status Smart Contracts No bounty
iOS apps 1
- https://apps.apple.com/us/app/status-private-communication/id1178893006 No bounty
Out of scope (4)
- discuss.status.im
- dev.*.status.im
- *.staging.status.im
- test.*.status.im
Changes
Tracked since 12 Nov 2026. Last checked 1 hour ago.
-
Paused
Paused. Not accepting reports right now.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Status
Program status changed
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-25780 | It is identified a vulnerability of insufficient authentication in an important specific function of Status PowerBPM. A LAN attacker with normal user privilege can exploit this vulnerability to modify substitute agent to arbitrary users, resulting in serious consequence. | Medium 5.7 | 2 Jun 2023 |
| CVE-2010-4658 | statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks. | Medium 5.3 | 7 Feb 2020 |
| CVE-2010-4659 | Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents. | Medium 6.1 | 20 Nov 2019 |
| CVE-2010-4660 | Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes.. | Critical 9.8 | 20 Nov 2019 |
| CVE-2011-3370 | statusnet before 0.9.9 has XSS | Medium 6.1 | 12 Nov 2019 |
| CVE-2019-12164 | ubuntu-server.js in Status React Native Desktop before v0.57.8_mobile_ui allows Remote Code Execution. | Critical 9.8 | 23 Jul 2019 |
| CVE-2013-4137 | Multiple SQL injection vulnerabilities in StatusNet 1.0 before 1.0.2 and 1.1.0 allow remote attackers to execute arbitrary SQL commands via vectors related to user lists and "a particular tag format." | High 7.5 | 11 Oct 2013 |
| CVE-2011-3802 | StatusNet 0.9.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tpl/index.php and certain other files. | Medium 5.0 | 24 Sep 2011 |