In brief. Discourse is a bug bounty program on HackerOne. It received 371 reports in the 90 days to November 7, 2026, about 186 per in-scope asset. As of Nov 7, 2026. Markdown for agents

NR Unrated

Discourse

Discourse HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at Discourse? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 7 Nov 2026.

What it pays, by severity

Critical amount not published 8 reports

High amount not published 89 reports

Medium amount not published 119 reports

Low amount not published 56 reports

$118,138 paid to researchers in total. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received

371

in 90 days

Resolved

285

all time, last one 2 months ago

Participants

282

hunters engaged

Response efficiency

18%

failed, HackerOne’s figure

SLA misses

targets missed

Reports received, day by day, last 30 days 368–410

9 Oct 371 reports 7 Nov

Response targets it sets itself

First response

5 days

Triage

10 days

Bounty

60 days

Resolution

60 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

Open to submit. HackerOne lists no requirements for submitting a report here.

Over 77 days (77 snapshots): intake down 105 reports; response efficiency down 45 points.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

297 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	vultza	748	19 / 22 86%
2	mokusou	377	13 / 14 93%
3	daroo	361	7 / 9 78%
4	forfun	274	7 / 7 100%
5	prasetia	270	9 / 13 69%
6	taise	267	6 / 10 60%
7	imlonghao	259	7 / 8 88%
8	se1en	246	8 / 20 40%
9	marotagem_vrt	242	6 / 6 100%
9	b62ba6bd20eb778df2a0691	57	1 / 2 50%
10	mishre	211	8 / 9 89%
11	jerry3	206	8 / 20 40%
12	gregxsunday	183	4 / 6 67%
13	ooooooo_q	142	6 / 9 67%
14	pentest_denlan	123	4 / 4 100%
15	sqeezelemon	118	4 / 6 67%
16	joernchen	114	2 / 2 100%
16	ziot	114	2 / 2 100%
18	b4g32	111	4 / 8 50%
19	dpaysm	89	2 / 3 67%
20	skavans	86	3 / 4 75%
21	iliterate	81	3 / 6 50%
21	z01dberg	81	0 / 2 0%
23	fundi	79	2 / 8 25%
23	ryotak	79	2 / 2 100%

Showing the top 25 of 297 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 6 Nov 2026.

Discourse is JavaScript (ember.js) and Ruby on Rails based 100% open source discussion software -- https://github.com/discourse/discourse

Responsiveness

19% HackerOne’s figure

Swag

Currency

USD

Submissions

Open

Launched

Dec 2016

Scope entries

2 HackerOne’s count

Scope

2 assets

Asset	Type	Eligibility	Max severity
https://github.com/discourse/discourse	SOURCE CODE	✓ bounty	Critical
try.discourse.org	URL	✓ bounty	Critical

Known vulnerabilities in in-scope packages

294 from OSV.dev

Published vulnerabilities in the packages and repositories this program lists in scope, from the open OSV.dev database. They are already public, so they are context for where the code has broken before, not findings to report.

Advisory	Package	Severity	Published
CVE-2017-20290 Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to …	github.com/discourse/discourse	CVSS	22 Oct 2026
CVE-2026-91157 Discourse: Media uploads remain publicly accessible after category permissions are restricted	github.com/discourse/discourse	CVSS	14 Oct 2026
CVE-2026-91156 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users	github.com/discourse/discourse	CVSS	14 Oct 2026
CVE-2026-91159 Discourse: Stored oEmbed HTML injection via allowed iframe	github.com/discourse/discourse	CVSS	14 Oct 2026
CVE-2026-91119 Discourse: Encode action_code_who in mention URLs	github.com/discourse/discourse	CVSS	24 Sep 2026

Showing the newest 5 of 294.