# Stripchat: bug bounty program on HackerOne

> Stripchat is a bug bounty program on HackerOne. It received 174 reports in the 90 days to November 7, 2026, about 58 per in-scope asset.

- **Company:** Stripchat
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/stripchat
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** October 29, 2025
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/stripchat

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | not published | 2 |
| High | $1,250 | 7 |
| Medium | not published | 18 |
| Low | $200 | 22 |

- Reports received in the last 90 days: 174 (about 58 per in-scope asset)
- Bounties paid in the last 90 days: $1,850
- Bounties paid in total: $33,770
- Researchers participating: 65
- Response efficiency: 97%
- First-response target: 5 days
- Triage target: 10 days
- Bounty target: 14 days

## Scope

As imported from HackerOne on November 6, 2026: 3 assets in scope (3 bounty-eligible), 9 out of scope. The policy page is the authority.

- `*.stripchat.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `go.stripchat.com` (URL): in scope, bounty-eligible, max severity none
- `my.club` (URL): in scope, bounty-eligible, max severity critical
- `ext.stripchat.com` (URL): out of scope, max severity none
- `extensions.stripchat.com` (URL): out of scope, max severity none
- `https://stripchat.com/page*` (WILDCARD): out of scope, max severity none
- `https://stripchat.com/wiki` (URL): out of scope, max severity none
- `mta*.stripchat.com` (WILDCARD): out of scope, max severity none
- `pxl.stripchat.com` (URL): out of scope, max severity none
- `support.stripchat.com` (URL): out of scope, max severity none
- `websocket-apps.sc-apps.com` (URL): out of scope, max severity none
- `wiki.stripchat.com` (URL): out of scope, max severity none

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.