Does Brave Software have a bug bounty program?

Yes, Brave Software runs a public bug bounty program on HackerOne. It currently lists 5 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackerOne/brave

Brave Software

HackerOne·updated 20h ago

bountyopen

Discord → RSS

payout: no bounty
scope: 5 in · 0 out
safe harbor: unknown
response: no reports

open program

hunt score

cashfresh

formula →

payout

0/55

bounty

20/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

5 in-scope

3other
1ios
1source

Scope

In scope

005

ios01

+com.brave.ios.browser· critical

source code01

+github.com/brave/*, https://github.com/brave-intl/*· critical

other03

+Brave Browser Desktop· critical
+Brave websites· critical
+com.brave.browser· critical

Out of scope

000

none listed

Change history

1 event

in-scope over 89dpeak 5

first indexedscope addedscope removedreward change

2026-08-06
first indexed
93d ago · 5 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Brave Software.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": 0,
  "url": "https://hackerone.com/brave",
  "name": "Brave Software",
  "handle": "brave",
  "targets": {
    "in_scope": [
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "Please specify operating system and version of Brave. Only issues in the latest nightly/beta/stable releases are in scope.",
        "max_severity": "critical",
        "asset_identifier": "Brave Browser Desktop",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "This includes but is not limited to Brave Search, Brave Search API dashboard, Brave Creators, Brave Accounts, Brave Talk, and Brave Ads dashboard. Please do not report issues that have no real user impact.",
        "max_severity": "critical",
        "asset_identifier": "Brave websites",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "com.brave.browser",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "com.brave.ios.browser",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "In general we're interested in vulnerabilities in all GitHub repos under brave/ and brave-intl/, barring explicit exclusions. Also exclude forks and archived repos.",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/brave/*, https://github.com/brave-intl/*",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": []
  },
  "website": "https://brave.com",
  "offers_swag": false,
  "managed_program": false,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 86,
  "response_efficiency_percentage": 99,
  "average_time_to_report_resolved": null,
  "average_time_to_first_program_response": 13
}