Infosec Institute

Open Bug Bounty mentioned in the
Top 6 Bug Bounty programs of
2022 by the InfoSec Institute

The Hacker News

Open Bug Bounty named among the
Top 5 Bug Bounty programs of 2021
by The Hacker News

Platform update: please use our new authentication mechanism to securely use the Open Bug Bounty Platform.
For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,722,214 coordinated disclosures
1,391,894 fixed vulnerabilities
2,014 bug bounty programs, 3,932 websites
48,641 researchers, 1,657 honor badges

Family Home Plans Bug Bounty Program

Family Home Plans runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Family Home Plans

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Family Home Plans and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:


Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

- Always send a working proof of concept (PoC)
- Always send a CVE ID reference ( and CVSS score ( if available
- Attach screenshots of the vulnerability and/or provide a link showing or demonstrating the vulnerability
- Provide brief remediation guidelines or suggestions on how to resolve the vulnerability

Testing Requirements:

- Do not use vulnerability scanners
- Do not use website tools that will stress the website
- Do not test during weekends or US holidays
- Do not conduct any tests that might cause a website failure or outage
- Do not conduct any tests that might disrupt the normal operation of the website or server
- Do not perform social engineering attacks

Possible Awards:

- A recommendation in researcher's profile in OpenBugBounty
- Mention in the OpenBugBounty Hall of Fame or something more valuable proportional to the researcher's efforts
- Up to $500 for critical findings. Those include findings with CVSS scores 9 to 10
- Up to $250 for high-risk findings, t-shirts and kudos for other valid findings. Those include CVSS scores 7 to 8.
- Up to $100 for moderate risk findings. Those include CVSS scores below 7.

Special Notes:

- You must not disclose or discuss and found vulnerabilities anywhere to be eligible to receive an award
- Vulnerabilities that have already been reported are not eligible for an award

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched


  Latest Blog Posts

04.12.2023 by BAx99x
Unmasking the Power of Cross-Site Scripting (XSS): Types, Exploitation, Detection, and Tools
04.12.2023 by a13h1_
$1120: ATO Bug in Twitter’s
04.12.2023 by ClumsyLulz
How I found a Zero Day in W3 Schools
04.12.2023 by 24bkdoor
Hack the Web like a Pirate: Identifying Vulnerabilities with Style
04.12.2023 by 24bkdoor
Navigating the Bounty Seas with Open Bug Bounty

  Recent Recommendations

    4 June, 2024
Researcher reported public Docker local env file, no security breach but this file should not be publicly available, thanks SYPltd.
    4 June, 2024
Researcher reported public local env Docker file, no security breach but file should not be publicly available, thank you SYPltd.
    29 May, 2024
It was the first time for us that we received a report about openbugbounty. The researcher reported a demo dockerfile on our website. No security breach but it's not "professionnal" to see this kind of file on a website.
Thank you SYPltd
    28 May, 2024
Thank you very much for your support and uncovering the vulnerabilities.
    28 May, 2024
Thank you very much for your support and uncovering the vulnerabilities.