How does it work?

Find a security issue.

Locate a security issue on the Vultr platform, the customer portal, or with our API.

1

Write to us.

Create a report, including steps to reproduce the bug, and attach additional evidence if needed.

2

Receive a reward!

The higher the severity of the bug, the higher the value of the payout.

3

What is the scope of the bug bounty program?

The Vultr.com websites my.vultr.com, www.vultr.com, api.vultr.com are all within scope. The accepted categories include injection attacks, authentication or authorization flaws, cross-site scripting, sensitive data exposure, privilege escalation, and other security issues.

What issues are out of scope?

  • Customer Instances

    Vultr.com customer instances are not in scope. Many instances have default hostnames or reverse DNS ending in "vultr.com", presence of that does not imply that an IP is in scope. If you have any questions about whether or not something is in scope, please contact us before you take any action.
  • DDoS Attacks

    Any sort of DoS/DDoS attacks are strictly forbidden.
  • Automated Scan Reports

    These are generally very noisy and have a very high false positive rate and are not in scope.
  • Compromised Customers

    Bugs requiring the user to be compromised or to have malicious browser extensions are not in scope.
  • Operating Systems

    Vulnerabilities in the operating systems we provide are not in scope unless the issue is directly caused by modifications we have made to it.
  • Deprecated Browsers

    Exploits that require the end user to run an outdated or legacy web browser are not in scope.
  • Support Tickets

    Please do not submit large volume of support tickets or replies. This can cause delays for other customers with actual problems.

Report an Issue

If you find a security vulnerability anywhere on the Vultr platform, it is our priority to work with you to resolve the issue. Our engineering team will promptly review all bug bounty submissions and compensate reporters for the ethical disclosure of verifiable exploits. The level of award is determined based on the severity, complexity, and scope of the exploit.

Bug Type

Bug Location

Description

Attachments

Contact

Get started in the SSD Cloud!