# Chainstack: bug bounty program on HackenProof

> Chainstack is a bug bounty program on HackenProof. 10 assets are listed in scope, 10 of them bounty-eligible.

- **Company:** Chainstack
- **Platform:** HackenProof
- **Program page:** https://hackenproof.com/programs/chainstack
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** February 15, 2023
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/chainstack

## Scope

As imported from HackenProof on October 21, 2026: 10 assets in scope (10 bounty-eligible), 5 out of scope. The policy page is the authority.

- `*.console.chainstack.com` (WILDCARD): in scope, bounty-eligible, max severity medium
- `*.core.chainstack.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `*.p2pify.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `*.prod-networks.chainstack.com` (WILDCARD): in scope, bounty-eligible, max severity high
- `api.chainstack.com` (URL): in scope, bounty-eligible, max severity critical
- `chainstack.com` (URL): in scope, bounty-eligible, max severity critical
- `console.chainstack.com` (URL): in scope, bounty-eligible, max severity critical
- `docs.chainstack.com` (URL): in scope, bounty-eligible, max severity medium
- `faucet.chainstack.com` (URL): in scope, bounty-eligible, max severity high
- `mcp.chainstack.com` (URL): in scope, bounty-eligible, max severity high
- `chainstack.dev and all subdomains` (WEB): out of scope
- `chainstacklabs.com and all subdomains` (WEB): out of scope
- `dev.chainstack.com and all subdomains` (WEB): out of scope
- `int.chainstack.com and all subdomains` (INFRASTRUCTURE): out of scope
- `staging*.chainstack.com and all subdomains` (WEB): out of scope

---

Generated October 24, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.