# ClickHouse: bug bounty program on Bugcrowd

> ClickHouse is a bug bounty program on Bugcrowd. Bounties range from $50 to $2,500. 4 assets are listed in scope, 4 of them bounty-eligible.

- **Company:** ClickHouse
- **Platform:** Bugcrowd
- **Program page:** /engagements/clickhouse
- **Pays bounties:** yes
- **Submissions:** open
- **Bounty range:** $50 to $2,500
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/clickhouse

## Scope

As imported from Bugcrowd on November 6, 2026: 4 assets in scope (4 bounty-eligible), 4 out of scope. The policy page is the authority.

- `ClickHouse Cloud environment hosted by ClickHouse` (other): in scope, bounty-eligible
- `https://clickhou.se/bugcrowd` (website): in scope, bounty-eligible
- `https://cloud.langfuse.com/` (website): in scope, bounty-eligible
- `https://github.com/ClickHouse/ClickHouse` (other): in scope, bounty-eligible
- `learn.clickhouse.com` (website): out of scope
- `New support cases, Chat, Request new integration form` (website): out of scope
- `Share feedback form` (website): out of scope
- `Vulnerability scanners` (website): out of scope

## Recent public accepted findings

- November 6, 2026: high severity on https://github.com/ClickHouse/ClickHouse
- November 5, 2026: medium severity on https://github.com/ClickHouse/ClickHouse
- November 5, 2026: medium severity on https://github.com/ClickHouse/ClickHouse
- November 5, 2026: medium severity on https://github.com/ClickHouse/ClickHouse
- November 5, 2026: medium severity on https://github.com/ClickHouse/ClickHouse

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.