# Nebius AI Vulnerability Disclosure: vulnerability disclosure program on HackerOne

> Nebius AI Vulnerability Disclosure is a vulnerability disclosure program on HackerOne. It does not pay bounties. It received 303 reports in the 90 days to November 7, 2026, about 14 per in-scope asset.

- **Company:** Nebius AI Vulnerability Disclosure
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/nebius_ai_vdp
- **Pays bounties:** no
- **Submissions:** open
- **Launched:** September 23, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/nebius-ai-vdp

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

- Reports received in the last 90 days: 303 (about 14 per in-scope asset)
- Researchers participating: 0
- Response efficiency: 81%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 21 assets in scope (0 bounty-eligible), 0 out of scope. The policy page is the authority.

- `api.nebius.cloud` (URL): in scope, no bounty, max severity critical
- `api.tokenfactory.nebius.com` (URL): in scope, no bounty, max severity critical
- `assets.nebius.com` (URL): in scope, no bounty, max severity critical
- `auth.nebius.com` (URL): in scope, no bounty, max severity critical
- `auth.tokenfactory.nebius.com` (URL): in scope, no bounty, max severity critical
- `careers.nebius.com` (URL): in scope, no bounty, max severity medium
- `console.eu.nebius.com` (URL): in scope, no bounty, max severity critical
- `console.nebius.com` (URL): in scope, no bounty, max severity critical
- `dev.nebius.com` (URL): in scope, no bounty, max severity medium
- `docs.nebius.com` (URL): in scope, no bounty, max severity medium
- `docs.tokenfactory.nebius.com` (URL): in scope, no bounty, max severity medium
- `https://github.com/nebius/gosdk` (SOURCE_CODE): in scope, no bounty, max severity critical
- `https://github.com/nebius/js-sdk` (SOURCE_CODE): in scope, no bounty, max severity critical
- `https://github.com/nebius/nebius-observability-agent-updater` (SOURCE_CODE): in scope, no bounty, max severity critical
- `https://github.com/nebius/pysdk` (SOURCE_CODE): in scope, no bounty, max severity critical
- `https://github.com/nebius/terraform-provider-nebius` (SOURCE_CODE): in scope, no bounty, max severity critical
- `nebius.com` (URL): in scope, no bounty, max severity medium
- `static.nebius.com` (URL): in scope, no bounty, max severity critical
- `status.nebius.com` (URL): in scope, no bounty, max severity critical
- `sts.nebius.com` (URL): in scope, no bounty, max severity critical
- `tokenfactory.nebius.com` (URL): in scope, no bounty, max severity critical

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.