Bug Bounty · Reports open

Break something real. Bring enough evidence.

Reproducible product defects can enter severity-led review. Reports are open, but a submission is not a promise of payment. Exact award bands, dates, budgets, and caps apply only when published campaign terms say they are active.

Report a bug Report security privately

GOBBL inspecting a mechanical defect beside five severity gauges

Severity guides review.

Impact and reproducibility matter more than report length or dramatic wreckage prose.

Minor

A real cosmetic or usability defect with limited impact.

Low

A reproducible defect with a practical workaround.

Medium

An important workflow fails or produces materially incorrect state.

High

A major outage, data-loss risk, or meaningful account impact.

Critical

A severe security or systemic issue requiring private review.

A useful report includes

What happened, what you expected, and why the difference matters.
Exact steps that reproduce the problem, including device and browser when relevant.
Evidence such as screenshots, timestamps, affected routes, or a safe test account.
One report per distinct defect; add context to an existing case instead of duplicating it.

Keep security issues private.

Do not exploit, publish, or retain other people's data. Use the private security route and allow time for remediation before any approved disclosure.

Open a private security report →

Before you submit

Not every report earns an award.

Duplicate, known, expected, unreproducible, incomplete, abusive, or automated-noise reports may receive no award. Reports can still help improve the product even when no funded bounty terms are open. That distinction stays visible instead of turning every support ticket into a financial promise.

GOBBL

Loading your next view…