- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report through their form
- wakatime.com/leaks
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
Scope
1 asset you may test.
Web 1
- wakatime.com Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from WakaTime (via HackerOne)'s policy.
While testing
-
Please consolidate the same vulnerability reports when only the page/url/params changes.
-
Do NOT report leaked user api keys, user passwords, user app secrets, or other user secrets here.
Not accepted
-
Session Fixation/Replay
-
Insufficient Session Expiration
-
Weak Password Policy
-
Password Reuse
-
CSRF Cookie Without 'HttpOnly' Flag
-
Beast Attack
-
Username Enumeration
-
Software version disclosure
-
Denial of service
-
Spamming
-
Phishing
-
Social engineering
-
leaked user api keys, user passwords, user app secrets, or other user secrets
Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
In Scope
- wakatime.com
- api.wakatime.com (web only, not used for email)
Out of Scope Vulnerabilities
Report leaked user api keys, user passwords, and other sensitive user data using this form: https://wakatime.com/leaks Do NOT report leaked user api keys, user passwords, user app secrets, or other user secrets here. They will be marked NA!
Vulnerabilities below will be marked NA or Informative.
- Session Fixation/Replay (We use session cookies and we like them http://bit.ly/2tw19Gd)
- Insufficient Session Expiration
- Weak Password Policy (See http://bit.ly/2uFjwXt)
- Password Reuse (We allow any password, even passwords used previously)
- CSRF Cookie Without 'HttpOnly' Flag
- Beast Attack (Fixed in browsers not sever)
- Username Enumeration
- Software version disclosure
- Denial of service
- Spamming
- Phishing
- Social engineering
- status.wakatime.com is NOT in scope. Submit vuln reports to [email protected] for our status page subdomain.
Please consolidate the same vulnerability reports when only the page/url/params changes.