# MongoDB: bug bounty program on HackerOne

> MongoDB is a bug bounty program on HackerOne. Its critical reports have paid an average of $8,500 across 19 reports (HackerOne figures, November 7, 2026). It received 2,029 reports in the 90 days to November 7, 2026, about 29 per in-scope asset.

- **Company:** MongoDB
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/mongodb
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** September 1, 2022
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/mongodb

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $8,500 | 19 |
| High | $2,540 | 52 |
| Medium | $480 | 143 |
| Low | $109 | 123 |

- Reports received in the last 90 days: 2,029 (about 29 per in-scope asset)
- Bounties paid in the last 90 days: $78,650
- Bounties paid in total: $448,799
- Researchers participating: 311
- Response efficiency: 80%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 71 assets in scope (64 bounty-eligible), 3 out of scope. The policy page is the authority.

- `.NET Driver` (OTHER): in scope, bounty-eligible, max severity critical
- `*.account.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.atlas.mongodb.com/*` (URL): in scope, bounty-eligible, max severity critical
- `*.blog.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.cloud.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.compass.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.corp.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.dev.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.forums.realm.io/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.infosec.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.marian.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.students.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.support.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.transport.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*.university.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `*corp.mongodb.com` (OTHER): in scope, bounty-eligible, max severity critical
- `Artifactory` (OTHER): in scope, bounty-eligible, max severity critical
- `artifactory.corp.mongodb.com/` (URL): in scope, bounty-eligible, max severity critical
- `Atlas Charts` (OTHER): in scope, bounty-eligible, max severity critical
- `Atlas Data Federation` (OTHER): in scope, bounty-eligible, max severity critical
- `Atlas IAM` (OTHER): in scope, bounty-eligible, max severity critical
- `Atlas Infinite` (OTHER): in scope, bounty-eligible, max severity critical
- `Atlas Payments/Billing` (OTHER): in scope, bounty-eligible, max severity critical
- `Atlas Search` (OTHER): in scope, bounty-eligible, max severity critical
- `BI Connector` (OTHER): in scope, bounty-eligible, max severity critical
- `C Driver` (OTHER): in scope, bounty-eligible, max severity critical
- `C# Driver` (OTHER): in scope, bounty-eligible, max severity critical
- `C++ Driver` (OTHER): in scope, bounty-eligible, max severity critical
- `Cluster-To-Cluster sync` (OTHER): in scope, bounty-eligible, max severity critical
- `Compass` (OTHER): in scope, bounty-eligible, max severity critical
- `Database Tools` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `Drivers` (DOWNLOADABLE_EXECUTABLES): in scope, bounty-eligible, max severity critical
- `Enterprise Edition Products and Tools` (OTHER): in scope, bounty-eligible, max severity critical
- `Evergreen` (OTHER): in scope, bounty-eligible, max severity critical
- `GO Driver` (OTHER): in scope, bounty-eligible, max severity critical
- `https://*.api.mongodb.com/*` (OTHER): in scope, bounty-eligible, max severity critical
- `https://*.corp.mongodb.com*` (WILDCARD): in scope, bounty-eligible, max severity critical
- `Java Driver` (OTHER): in scope, bounty-eligible, max severity critical
- `Jira Projects` (OTHER): in scope, bounty-eligible, max severity critical
- and 34 more on the BugRater page

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.