Patchstack pays a fixed bounty for high value vulnerabilities.
Members of the Bug Bounty program receive XP for their reports and are eligible for monthly cash rewards.
$2,000Top ranking contributor
$1,400Contributor ranking 2nd
$800Contributor ranking 3rd
$600Contributor ranking 4th
$500Contributor ranking 5th
$400Contributor ranking 6th to 10th
$200Contributor ranking 11th to 15th
$100Contributor ranking 16th to 19th
$50Contributors ranking 20th
$50One lucky pick
Eligibility and responsibility
We would like to thank everyone who submits valid reports that help us improve the security of . However, only those that meet the following eligibility requirements may receive a monetary reward for vulnerabilities found in the source code.
You must be the first reporter of a vulnerability.
The vulnerability must be a qualifying vulnerability (see below).
Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through patchstack.com.
You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit your requests per second). If you over do it, your IP address might be throttled or even (temporarily) blocked to protect our infrastructure. See how.
Reports on vulnerabilities are examined by our security analysts - our analysis is always based on worst case exploitation & the business criticality of the vulnerability, as is the reward we pay.