# Ruby: bug bounty program on HackerOne

> Ruby is a bug bounty program on HackerOne. It received 139 reports in the 90 days to November 9, 2026, about 139 per in-scope asset.

- **Company:** Ruby
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/ruby
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** June 17, 2016
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/ruby

## Payouts and volume

HackerOne's own published figures, captured November 9, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | not published | 2 |
| High | not published | 11 |
| Medium | not published | 18 |
| Low | not published | 14 |

- Reports received in the last 90 days: 139 (about 139 per in-scope asset)
- Bounties paid in total: $10,000
- Researchers participating: 81
- Response efficiency: 90%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days
- Barriers: bounty amounts hidden

## Scope

As imported from HackerOne on November 8, 2026: 1 assets in scope (0 bounty-eligible), 1 out of scope. The policy page is the authority.

- `*.ruby-lang.org` (WILDCARD): out of scope, max severity none
- `https://github.com/ruby/ruby` (SOURCE_CODE): in scope, no bounty, max severity critical

---

Generated November 9, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.