Skip to content

doc: update bug bounty program #62590

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RafaelGSS wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −3
Open

doc: update bug bounty program #62590

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,7 @@ response or engagement within 14 days, escalation is also appropriate.

### Node.js bug bounty program

The Node.js project engages in an official bug bounty program for security
researchers and responsible public disclosures. The program is managed through
the HackerOne platform. See <https://hackerone.com/nodejs> for further details.
The Node.js project no longer has a bug bounty program.
Copy link
Copy Markdown
Member

@marco-ippolito marco-ippolito Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would still mention hackerone though saying we have a program but dont pay bounties

Copy link
Copy Markdown
Contributor

@MikeMcC399 MikeMcC399 Apr 5, 2026 •
edited by aduh95
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's still mentioned in Line 5

node/SECURITY.md

Line 5 in 12249cc

Report security bugs in Node.js via [HackerOne](https://hackerone.com/nodejs).

Copy link
Copy Markdown
Contributor

@MikeMcC399 MikeMcC399 Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://hackerone.com/nodejs is still showing an active bug bounty program, so currently it would be confusing to have a link to it in the section which says there is no longer a bug bounty program


## Reporting a bug in a third-party module

Expand Down
Loading