- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
Unfortunately, we cannot offer any financial rewards right now, as this project is open-source without any revenue.
- Hall of fame
-
Yes
We hope that [public credit](https://hackerone.com/versioncake/thanks) and the feeling of having done good may be gratifying.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test.
Source code 1
- https://github.com/bwillis/versioncake Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Version Cake (via HackerOne)'s policy.
Not accepted
-
reporting dependencies being out of date
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
{F244645}
Version Cake is a simple open source Ruby gem, but believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue, we encourage you to notify us. We welcome working with you to resolve the issue promptly.
Responsible disclosure
An issue will be publicly disclosed in the changelog once a version is posted with the patch applied.
Bounties and rewards
Unfortunately, we cannot offer any financial rewards right now, as this project is open-source without any revenue. We hope that public credit and the feeling of having done good may be gratifying.
Non qualifying reports
Please note, while nice, reporting dependencies being out of date is not necessary and won't be rewarded with Resolved status. The dependencies are publicly reported and notifications are sent to the team when they need updating.
Thank you for helping keep Version Cake and our users safe!