Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Zenya

By Zenya / Infoland Bug bounty on Self-hosted zenya-software.com

Accepting reports
Go to program Website
Top reward
Not published
Top severity paid
Not published
Assets in scope
0
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays cash
Amounts are not published; ask before you invest time.
Report by email
https://forms.zenya.work/psbr6j9omo/1325
Partial safe harbor
Some legal protection; read the terms.
Replies within 5 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash
Yes Depending on the severity of the security problem and the quality of the report Zenya will offer a reward to thank you for your help.
Response
Within 5 days Acknowledging your report within 5 business days.
Safe harbor
Partial Provide us with a reasonable amount of time to address the issue; don’t reveal the problem to others until it has been resolved.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

0 assets you may test, 17 excluded.

Self-hosted does not list the scope of this program publicly. Check its policy.

Out of scope (17)
  • Anonymous access to the Zenya API (by design)
  • Clickjacking, vulnerabilities that can only be exploited through clickjacking
  • Cosmetical level issues, i.e. this does not look good in browser A.
  • E-mail addresses found at a third party data breach
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages and content spoofing/text injections in these pages
  • Incomplete or missing SPF, DKIM or DMARC records
  • Missing security headers, options and flags
  • Outdated versions without proof-of-concept or working exploit
  • Public files or directories that do not contain confidential information
  • Rate-limiting with no apparent impact
  • Registered public IP addresses
  • Resource exhaustion / (Distributed) Denial of Service.
  • Services running at third party service providers (verify their responsible disclosure statement on beforehand)
  • Simple fingerprinting or version listings on OS, services or ports
  • Situations that cannot be reproduced; Exploits that are not validated with a second tool/method, i.e. wrong result in tool A, right result in tool B
  • TLS misconfiguration without a proof of concept to exploit the weakness
  • URL redirection (to a valid webpage)

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Zenya's policy. "We" in these lines means the program, not this site.

While testing

  • Report the vulnerability as soon as possible after discovering it.
  • Do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability or deleting or modifying data.
  • Provide us with a reasonable amount of time to address the issue; don’t reveal the problem to others until it has been resolved.
  • Introduce malware into the system.
  • Copy, edit or delete data in the system.
  • Make changes to the system.
  • Repeatedly access the system or share access to the system with others.
  • Perform brute-force attacks to gain access to a system.
  • Perform denial-of-service attacks or social engineering.

Not accepted

  • Simple fingerprinting or version listings on OS, services or ports
  • Registered public IP addresses
  • Incomplete or missing SPF, DKIM or DMARC records
  • Outdated versions without proof-of-concept or working exploit
  • E-mail addresses found at a third party data breach
  • Cosmetical level issues, i.e. this does not look good in browser A.
  • Public files or directories that do not contain confidential information
  • Missing security headers, options and flags
  • URL redirection (to a valid webpage)
  • TLS misconfiguration without a proof of concept to exploit the weakness
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages and content spoofing/text injections in these pages
  • Clickjacking, vulnerabilities that can only be exploited through clickjacking
  • Resource exhaustion / (Distributed) Denial of Service.
  • Situations that cannot be reproduced; Exploits that are not validated with a second tool/method, i.e. wrong result in tool A, right result in tool B
  • Rate-limiting with no apparent impact
  • Services running at third party service providers (verify their responsible disclosure statement on beforehand)
  • Anonymous access to the Zenya API (by design)

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.