Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Titan OS

Vulnerability disclosure program on security.txt titanos.tv

Accepting reports security.txt
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
5
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Partial safe harbor
Some legal protection; read the terms.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No Titan OS does not currently offer monetary rewards.
Safe harbor
Partial It is given by Titan OS and it binds Titan OS only.
Hall of fame
Yes We are glad to credit reporters, or to leave you unnamed, whichever you prefer.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

5 assets you may test, 13 excluded.

Domains 1

  • titanos.tv

Products and areas 4

  • Mobile and web applications delivered as part of a Titan OS offering
  • the backend and cloud services that support Titan OS functionality
  • third-party and open-source components that ship inside Titan OS software
  • Titan OS software integrated into smart televisions, including firmware and embedded software
Out of scope (13)
  • Automated scanner output submitted without any demonstration of impact.
  • Broken links, mixed content, error pages revealing nothing sensitive, and self-inflicted issues that cannot be used against another user.
  • Clickjacking or open redirect on non-sensitive pages, and cross-site request forgery on non-sensitive or unauthenticated endpoints, without demonstrated impact.
  • Content-protection bypass.
  • Crashes that do not lead to code execution, privilege escalation, or a persistent loss of function.
  • Interface glitches and cosmetic errors with no security impact.
  • Issues affecting only rooted, modified or otherwise unsupported builds.
  • Metadata or version disclosure that exposes nothing sensitive.
  • Missing hardening measures that do not enable exploitation, and absence of rate limiting on non-sensitive actions.
  • Physical attacks requiring disassembly, JTAG or debug ports.
  • Social engineering or phishing of Titan OS staff or partners.
  • Volumetric network flooding.
  • Vulnerabilities in systems or services not owned or operated by Titan OS.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Titan OS's policy. "We" in these lines means the program, not this site.

While testing

  • Avoid privacy violations, destruction of data, and disruption of service.
  • Test only systems you own or are authorised to test, and only Titan OS software within the scope above.
  • Do not exploit a vulnerability beyond what is needed to demonstrate it, and do not pivot, persist or exfiltrate data.
  • Do not disclose publicly without coordinating with us.
  • Do not attempt to access personal or sensitive data.
  • Please keep any hosted proof-of-concept media private.
  • Reports should be in English or Spanish.
  • If you are unsure whether something is authorised, ask us at [email protected] before proceeding.

Not accepted

  • Physical attacks requiring disassembly, JTAG or debug ports.
  • Social engineering or phishing of Titan OS staff or partners.
  • Volumetric network flooding.
  • Issues affecting only rooted, modified or otherwise unsupported builds.
  • Interface glitches and cosmetic errors with no security impact.
  • Crashes that do not lead to code execution, privilege escalation, or a persistent loss of function.
  • Content-protection bypass.
  • Metadata or version disclosure that exposes nothing sensitive.
  • Automated scanner output submitted without any demonstration of impact.
  • Clickjacking or open redirect on non-sensitive pages, and cross-site request forgery on non-sensitive or unauthenticated endpoints, without demonstrated impact.
  • Missing hardening measures that do not enable exploitation, and absence of rate limiting on non-sensitive actions.
  • Broken links, mixed content, error pages revealing nothing sensitive, and self-inflicted issues that cannot be used against another user.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 12 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.