Open Bug Bounty selected among the
Top 5 Bug Bounty programs to watch
in 2021 by The Hacker News

For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,202,930 coordinated disclosures
811,950 fixed vulnerabilities
1,570 bug bounty programs, 3,120 websites
27,909 researchers, 1,427 honor badges

Drupal Bug Bounty Program

Drupal runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Drupal

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Drupal and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

drupal.org

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Please refer to https://www.drupal.org/drupalorg/docs/build/drupalorg-bug-bounty-program for details of our program.

Testing Requirements:

Vulnerabilities should be verified as authentic, and not simply automated results of pen-tests.

Possible Awards:

At this time, the Drupal Association does not have any active reward program for reported vulnerabilities.

Special Notes:

We prefer that you contact us through: https://www.drupal.org/drupalorg/docs/build/drupalorg-bug-bounty-program rather than through the OpenBugBounty platform

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

Achchhelalch     19 March, 2022
    Achchhelalch:
Intermediate level bug hunter

  Latest Patched

 16.05.2022 baclieu.gov.vn
 16.05.2022 essuir.sumdu.edu.ua
 16.05.2022 westerncape.gov.za
 16.05.2022 mobilecentre.am
 16.05.2022 e-store.bluebrand.me
 16.05.2022 jic.edu.sa
 16.05.2022 faculdadefacit.edu.br
 16.05.2022 dochkisinochki.ru
 16.05.2022 uner.edu.ar
 16.05.2022 trangnguyen.edu.vn

  Latest Blog Posts

15.02.2022 by sepkatpro
Ultimate XSS Polyglot
11.11.2021 by mistry4592
The Most used Chrome Extensions are Used For Penetration Testing.
08.10.2021 by NNeuchi
How I Found My First Bug Reflected Xss On PIA.GOV.PH(Philippine Information Agency)
26.08.2021 by PyaePhyoThu98
eG Manager v7.1.2: Improper Access Control lead to Remote Code Execution (CVE-2020-8591)
14.07.2021 by Open Bug Bounty
Interview With Open Bug Bounty

  Recent Recommendations

@notedekd     28 April, 2022
    Twitter notedekd:
@singhnitesh21 provides precise and comprehensive vulnerable information. I highly appreciate the support and quick response.
@CERT_rlp     27 April, 2022
    Twitter CERT_rlp:
The team of CERT-rlp would like to thank Antonio for a responsible and coordinated disclosure of vulnerabilities
@DeanHalter     25 April, 2022
    Twitter DeanHalter:
Appreciate the skill and effort Nitesh and others in the open bounty, ethical hacker community bring to the table. He pointed out an XSS vulnerability on our website.
@TiagoGuedesEGo1     22 April, 2022
    Twitter TiagoGuedesEGo1:
Pranjal made us aware of several security vulnerabilities that represented security flaws of several degrees and needed to be rectified.

It was a pleasure working with him and I hope we can work again in the future, Thank you!
@DeanHalter     20 April, 2022
    Twitter DeanHalter:
Thank you for reporting the pair of XSS issues you found on our site. Your expertise and ethical reporting/handling helped us secure our website. Keep up the great and necessary work.