Private Packagist Bug Bounty Program

Private Packagist encourages users and independent security researchers to report detected security vulnerabilities. We appreciate the work of independent security researchers who review and test our service for security vulnerabilities because it makes Private Packagist more secure. We offer a bug bounty for the report of reproducible and unreported security vulnerabilities.

The amount of the bounty depends on the severity of the vulnerability as determined by Private Packagist and there is no guaranteed right to payment of a bounty.

Recommended Blogs

Password reset poisoning to ATO and OTP bypass

Abhishek

•

Aug 2, 2020

$5K Misconfigured Reset password that leads to Account Takeover (No user Interaction ATO)

Aditya Sharma

•

Aug 24, 2021

Bypassing LFI (Local File Inclusion)

Abhishek

•

Jun 3, 2021