H1 HackerOne LIVE
Cloudflare Public Bug Bounty
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.cloudflare.com/disclosure
- managed triage
- yes
- response efficiency
- 88%
- first response
- 1h avg
- time to bounty
- 872h avg
51 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
Workers AI | ai/ml | yes | critical | 2026-09-20 |
api.cloudflare.com | domain | yes | critical | 2026-09-20 |
cloudflareworkers.com | domain | yes | critical | 2026-09-20 |
dash.cloudflare.com | domain | yes | critical | 2026-09-20 |
http://github.com/cloudflare | domain | yes | critical | 2026-09-20 |
one.dash.cloudflare.com | domain | yes | critical | 2026-09-20 |
*.cloudflarepartners.com | other | yes | critical | 2026-09-20 |
1.1.1.1 Resolver | other | yes | critical | 2026-09-20 |
AI Gateway | other | yes | critical | 2026-09-20 |
AMP Real URL | other | yes | critical | 2026-09-20 |
API Shield | other | yes | critical | 2026-09-20 |
Area 1 | other | yes | critical | 2026-09-20 |
Bot Management | other | yes | critical | 2026-09-20 |
Browser Isolation | other | yes | critical | 2026-09-20 |
CDNJS | other | yes | critical | 2026-09-20 |
China Network | other | yes | critical | 2026-09-20 |
Cloudflare Access | other | yes | critical | 2026-09-20 |
Cloudflare Analytics | other | yes | critical | 2026-09-20 |
Cloudflare CASB | other | yes | critical | 2026-09-20 |
Cloudflare Cache | other | yes | critical | 2026-09-20 |
Cloudflare D1 | other | yes | critical | 2026-09-20 |
Cloudflare DNS | other | yes | critical | 2026-09-20 |
Cloudflare Durable Objects | other | yes | critical | 2026-09-20 |
Cloudflare Pages | other | yes | critical | 2026-09-20 |
Cloudflare R2 | other | yes | critical | 2026-09-20 |
Cloudflare Tunnel | other | yes | critical | 2026-09-20 |
Cloudflare Workers CI | other | yes | critical | 2026-09-20 |
Cloudflare Zaraz | other | yes | critical | 2026-09-20 |
Cloudflare Zero Trust/Cloudflare One | other | yes | critical | 2026-09-20 |
Data Loss Prevention (DLP) | other | yes | critical | 2026-09-20 |
Gateway | other | yes | critical | 2026-09-20 |
Hyperdrive | other | yes | critical | 2026-09-20 |
Images | other | yes | none | 2026-09-20 |
Load Balancing | other | yes | critical | 2026-09-20 |
Magic Firewall | other | yes | critical | 2026-09-20 |
Magic Transit | other | yes | critical | 2026-09-20 |
Magic WAN | other | yes | critical | 2026-09-20 |
Open source tools from Cloudflare | other | yes | critical | 2026-09-20 |
SSL/TLS | other | yes | critical | 2026-09-20 |
Spectrum | other | yes | critical | 2026-09-20 |
Stream | other | yes | critical | 2026-09-20 |
Vectorize | other | yes | critical | 2026-09-20 |
WARP Mobile Apps | other | yes | critical | 2026-09-20 |
WARP desktop client | other | yes | critical | 2026-09-20 |
Waiting Room | other | yes | critical | 2026-09-20 |
Workers | other | yes | critical | 2026-09-20 |
Workers KV | other | yes | critical | 2026-09-20 |
https://github.com/cloudflare/vinext | source code | yes | critical | 2026-09-20 |
https://github.com/cloudflare/workerd | source code | yes | critical | 2026-09-20 |
*.cloudflare.com | wildcard | yes | critical | 2026-09-20 |
*.teams.cloudflare.com | wildcard | yes | critical | 2026-09-20 |
26 out of scope — black ICE, don't touch
api.staging.realtime.cloudflare.comdomainapp.dyte.iodomaincommunity.cloudflare.comdomaindemo.realtime.cloudflare.comdomainevents.www.cloudflare.comdomainexamples.realtime.cloudflare.comdomainfiles.plugins.realtime.cloudflare.comdomainreact-examples.realtime.cloudflare.comdomainsupport.cloudflare.comdomainsupport.cloudflarewarp.comdomaintest.realtime.cloudflare.comdomainwaf.cumulusfire.netdomain172.65.0.0/16otherTurnstileotherhttps://github.com/cloudflare/agentic-inboxsource codehttps://github.com/cloudflare/cloudflare-ossource codehttps://github.com/cloudflare/computersource codehttps://github.com/cloudflare/moq-rssource codehttps://github.com/cloudflare/pp-browser-extensionsource codehttps://github.com/cloudflare/privacy-gateway-server-gosource codehttps://github.com/cloudflare/realtimekit-web-examplessource codehttps://github.com/cloudflare/recapnsource codehttps://github.com/cloudflare/saffron.gitsource codehttps://github.com/cloudflare/templatessource codehttps://github.com/cloudflare/vinext-privatesource code*.plugins.realtime.cloudflare.comwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.