Does ClickHouse have a bug bounty program?

Yes, ClickHouse runs a public bug bounty program on Bugcrowd, with rewards up to $2.5K. It currently lists 4 in-scope assets.

How much does ClickHouse pay for bug bounties?

ClickHouse's published reward range on Bugcrowd is up to $2.5K. Actual payouts depend on severity and scope.

Does ClickHouse offer safe harbor for security researchers?

Yes, ClickHouse publishes a safe-harbor clause protecting good-faith security research conducted within the program's scope and rules.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/Bugcrowd/engagements/clickhouse

ClickHouse

Bugcrowd·updated 18h ago

bountymanaged

Discord → RSS

max reward: $2.5K
scope: 4 in · 4 out
safe harbor: full
response: no reports

open program

hunt score

$cashfresh

formula →

payout

14/55

bounty

20/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

4 in-scope

2urls
2other

Scope

In scope

004

urls02

other02

+ClickHouse Cloud environment hosted by ClickHouse
+github.com/ClickHouse/ClickHouse

Out of scope

004

−New support cases, Chat, Request new integration formurl
−Share feedback formurl
−Vulnerability scannersurl
−learn.clickhouse.com/url

Change history

1 event

2026-08-06
first indexed
92d ago · 4 in-scope assets

// only one snapshot on record, changes appear from the next ingest onward

Community reports

0 reports

No reports yet. Be the first to share your triage timing for ClickHouse.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Similar programs

by shared scope

BugcrowdClickHouse4× overlap

Your notes

▸ raw source payload

{
  "url": "https://bugcrowd.com/engagements/clickhouse",
  "name": "ClickHouse",
  "targets": {
    "in_scope": [
      {
        "uri": "https://clickhou.se/bugcrowd",
        "name": "https://clickhou.se/bugcrowd",
        "type": "website",
        "target": "https://clickhou.se/bugcrowd",
        "ipAddress": null
      },
      {
        "uri": "",
        "name": "ClickHouse Cloud environment hosted by ClickHouse",
        "type": "other",
        "target": "ClickHouse Cloud environment hosted by ClickHouse",
        "ipAddress": null
      },
      {
        "uri": "https://github.com/ClickHouse/ClickHouse",
        "name": "https://github.com/ClickHouse/ClickHouse",
        "type": "other",
        "target": "https://github.com/ClickHouse/ClickHouse",
        "ipAddress": null
      },
      {
        "uri": "",
        "name": "https://cloud.langfuse.com/",
        "type": "website",
        "target": "https://cloud.langfuse.com/",
        "ipAddress": ""
      }
    ],
    "out_of_scope": [
      {
        "uri": "",
        "name": "New support cases, Chat, Request new integration form",
        "type": "website",
        "target": "New support cases, Chat, Request new integration form",
        "ipAddress": ""
      },
      {
        "uri": "",
        "name": "Share feedback form",
        "type": "website",
        "target": "Share feedback form",
        "ipAddress": ""
      },
      {
        "uri": "",
        "name": "Vulnerability scanners",
        "type": "website",
        "target": "Vulnerability scanners",
        "ipAddress": ""
      },
      {
        "uri": "https://learn.clickhouse.com/",
        "name": "learn.clickhouse.com",
        "type": "website",
        "target": "https://learn.clickhouse.com/",
        "ipAddress": ""
      }
    ]
  },
  "max_payout": 2500,
  "safe_harbor": "full",
  "allows_disclosure": false,
  "managed_by_bugcrowd": true
}