# Kong: bug bounty program on HackerOne

> Kong is a bug bounty program on HackerOne. Its critical reports have paid an average of $2,000 across 7 reports (HackerOne figures, November 2, 2026). It received 1,084 reports in the 90 days to November 2, 2026, about 60 per in-scope asset.

- **Company:** Kong
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/kong
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** October 21, 2025
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/kong

## Payouts and volume

HackerOne's own published figures, captured November 2, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $2,000 | 7 |
| High | $525 | 18 |
| Medium | $117 | 25 |
| Low | $100 | 9 |

- Reports received in the last 90 days: 1,084 (about 60 per in-scope asset)
- Bounties paid in the last 90 days: $24,000
- Bounties paid in total: $38,850
- Researchers participating: 126
- Response efficiency: 76%
- First-response target: 1 day
- Triage target: 10 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 2, 2026: 18 assets in scope (17 bounty-eligible), 12 out of scope. The policy page is the authority.

- `developer.konghq.com` (URL): in scope, bounty-eligible, max severity high
- `GitHub Actions` (OTHER): in scope, bounty-eligible, max severity critical
- `GitHub Actions in our Public Repositories` (OTHER): in scope, bounty-eligible, max severity none
- `http://cloud.konghq.com` (URL): in scope, bounty-eligible, max severity critical
- `https://*.api.konghq.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `https://app.insomnia.rest/` (URL): in scope, bounty-eligible, max severity critical
- `https://cloud.konghq.com` (URL): in scope, bounty-eligible, max severity critical
- `https://us.identity.konghq.com/*` (WILDCARD): in scope, bounty-eligible, max severity critical
- `Insomnia Desktop Client` (OTHER): in scope, bounty-eligible, max severity critical
- `Kong Gateway` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `Kong Gateway (OSS and Enterprise)` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `Kong Gateway Enterprise` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `Kong Gateway Plugins (Kong-Supported Only)` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `Kong Mesh` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `kong.my.site.com` (URL): in scope, bounty-eligible, max severity critical
- `konghq.com` (URL): in scope, bounty-eligible, max severity high
- `Subdomain Takeover - konghq.com` (OTHER): in scope, bounty-eligible, max severity high
- `*.*.edge.gateways.konghq.com` (WILDCARD): out of scope, max severity none
- `*.gateways.konghq.com` (WILDCARD): out of scope, max severity none
- `https://*.konghq.tech` (WILDCARD): out of scope, max severity none
- `https://docs.konghq.com` (URL): out of scope, max severity none
- `https://httpbin.konghq.com/` (URL): out of scope, max severity none
- `https://insomnia.rest/` (URL): out of scope, max severity none
- `https://konghq.com/` (URL): out of scope, max severity none
- `https://kuma.io/` (URL): out of scope, max severity none
- `Insomnia CLI (inso)` (DOWNLOADABLE_EXECUTABLES): out of scope, max severity none
- `Kong Enterprise Gateway - Sandbox Functionality` (OTHER): out of scope, max severity none
- `Kong Gateway OSS` (DOWNLOADABLE_EXECUTABLES): in scope, no bounty, max severity medium
- `Non-Kong GitHub Repositories` (OTHER): out of scope, max severity none
- `Non-Kong Plugins` (DOWNLOADABLE_EXECUTABLES): out of scope, max severity none

---

Generated November 8, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.