How does it work?

Find a security issue.

Locate a security issue on the Vultr platform, the customer portal, or with our API.


Write to us.

Create a report, including steps to reproduce the bug, and attach additional evidence if needed.


Receive a reward!

The higher the severity of the bug, the higher the value of the payout.


What is the scope of the bug bounty program?

The websites,, are all within scope. The accepted categories include injection attacks, authentication or authorization flaws, cross-site scripting, sensitive data exposure, privilege escalation, and other security issues.

What issues are out of scope?

  • Customer Instances customer instances are not in scope. Many instances have default hostnames or reverse DNS ending in "", presence of that does not imply that an IP is in scope. If you have any questions about whether or not something is in scope, please contact us before you take any action.
  • DDoS Attacks

    Any sort of DoS/DDoS attacks are strictly forbidden.
  • Automated Scan Reports

    These are generally very noisy and have a very high false positive rate and are not in scope.
  • Compromised Customers

    Bugs requiring the user to be compromised or to have malicious browser extensions are not in scope.
  • Operating Systems

    Vulnerabilities in the operating systems we provide are not in scope unless the issue is directly caused by modifications we have made to it.
  • Deprecated Browsers

    Exploits that require the end user to run an outdated or legacy web browser are not in scope.
  • Support Tickets

    Please do not submit large volume of support tickets or replies. This can cause delays for other customers with actual problems.
  • Third party sites

    Please do not attempt to register our support email for third party websites.

Report an Issue

If you find a security vulnerability anywhere on the Vultr platform, it is our priority to work with you to resolve the issue. Our engineering team will promptly review all bug bounty submissions and compensate reporters for the ethical disclosure of verifiable exploits. The level of award is determined based on the severity, complexity, and scope of the exploit.

Reports eligible for compensation will be paid with Vultr account credit or direct to your PayPal address.

Bug Type

Bug Location




Get started in the SSD Cloud!