In brief. Solidus is a vulnerability disclosure program on HackerOne. It does not pay bounties. It received 77 reports in the 90 days to November 7, 2026, about 39 per in-scope asset. As of Nov 7, 2026. Markdown for agents

NR Unrated

Solidus

Solidus HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at Solidus? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 7 Nov 2026.

What it pays, by severity

Critical amount not published 2 reports

High amount not published 6 reports

Medium amount not published 15 reports

Low amount not published 7 reports

Intake & responsiveness, last 90 days

Reports received

in 90 days

Resolved

all time, last one yesterday

Participants

hunters engaged

Response efficiency

89%

meeting its targets, HackerOne’s figure

SLA misses

targets missed

Reports received, day by day, last 30 days 35–77

9 Oct 77 reports 7 Nov

Response targets it sets itself

First response

5 days

Triage

10 days

Bounty

30 days

Resolution

30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

Open to submit. HackerOne lists no requirements for submitting a report here.

Over 78 days (125 snapshots): intake up 75 reports; response efficiency down 11 points.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

28 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	chrishsec	30	3 / 3 100%
2	gr33nreaper	28	2 / 3 67%
3	iammax0	14	2 / 2 100%
3	mooder1	14	2 / 2 100%
3	oxmr_zed	14	0 / 1 0%
6	1oryn	7	1 / 2 50%
6	5hady	7	1 / 1 100%
6	alex-pat	7	1 / 2 50%
6	cooked_potato	7	0 / 0
6	dennispaagman	7	0 / 0
6	emenalf	7	1 / 1 100%
6	ghosttrix	7	0 / 0
6	l0l1ch3ng	7	1 / 3 33%
6	mentsh	7	1 / 1 100%
6	mindthehack	7	1 / 1 100%
6	nathand	7	1 / 1 100%
6	oroan	7	1 / 1 100%
6	rkorzeniec	7	1 / 2 50%
6	rudikos	7	1 / 1 100%
6	samipmainali	7	1 / 1 100%
6	severin_sch	7	1 / 1 100%
6	startimeash	7	0 / 0
23	1ryn	2	1 / 2 50%
23	dark_river	2	1 / 1 100%
25	inc1ude	0	0 / 2 0%

Showing the top 25 of 28 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 7 Nov 2026.

A free, open source Ruby on Rails eCommerce platform.

Responsiveness

89% HackerOne’s figure

Swag

Offered

Currency

USD

Submissions

Open

Launched

Jun 2019

Scope entries

3 HackerOne’s count

Scope

3 assets

Asset	Type	Eligibility	Max severity
*solidus.io	WILDCARD	out	None
https://github.com/solidusio/solidus	SOURCE CODE	submit only	Critical
https://github.com/solidusio/solidus_auth_devise	SOURCE CODE	submit only	Critical

Known vulnerabilities in in-scope packages

6 from OSV.dev

Published vulnerabilities in the packages and repositories this program lists in scope, from the open OSV.dev database. They are already public, so they are context for where the code has broken before, not findings to report.

Advisory	Package	Severity	Published
CVE-2024-4859 Solidus <= 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL.	github.com/solidusio/solidus	CVSS	14 May 2024
CVE-2022-31000 CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend	github.com/solidusio/solidus	CVSS	1 Jun 2022
CVE-2021-43846 `solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and…	github.com/solidusio/solidus	CVSS	20 Dec 2021
CVE-2021-43805 Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of s…	github.com/solidusio/solidus	CVSS	7 Dec 2021
CVE-2021-41274 solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus…	github.com/solidusio/solidus_auth_devise	CVSS	17 Nov 2021

Showing the newest 5 of 6.