Visitar URL original
doc: update bug bounty program by RafaelGSS · Pull Request #62590 · nodejs/node · GitHub
Skip to content

doc: update bug bounty program #62590

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nodejs-github-bot merged 1 commit into from
Apr 6, 2026
Merged

doc: update bug bounty program #62590

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
doc: update bug bounty program 
https://nodejs.org/en/blog/announcements/discontinuing-security-bug-bounties
  • Loading branch information
@RafaelGSS
RafaelGSS authored Apr 4, 2026
commit 0a48aee07fba3684cdf200252bfa2455744beba6
4 changes: 1 addition & 3 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,7 @@ response or engagement within 14 days, escalation is also appropriate.

### Node.js bug bounty program

The Node.js project engages in an official bug bounty program for security
researchers and responsible public disclosures. The program is managed through
the HackerOne platform. See <https://hackerone.com/nodejs> for further details.
The Node.js project no longer has a bug bounty program.

@marco-ippolito marco-ippolito Apr 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would still mention hackerone though saying we have a program but dont pay bounties

@MikeMcC399 MikeMcC399 Apr 5, 2026 •
edited by aduh95
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's still mentioned in Line 5

node/SECURITY.md

Line 5 in 12249cc

Report security bugs in Node.js via [HackerOne](https://hackerone.com/nodejs).

@MikeMcC399 MikeMcC399 Apr 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://hackerone.com/nodejs is still showing an active bug bounty program, so currently it would be confusing to have a link to it in the section which says there is no longer a bug bounty program


## Reporting a bug in a third-party module

Expand Down
Loading