Does Cognition have a bug bounty program?

Cognition runs a public vulnerability disclosure program (VDP) on HackerOne. It accepts good-faith security reports but does not offer cash rewards. It lists 8 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackerOne/cognition

Cognition

HackerOne·updated 3h ago

vdpmanagedopen

Discord → RSS

payout: no bounty
scope: 8 in · 0 out
safe harbor: unknown
response: no reports

open program

hunt score

vdpfresh

formula →

payout

0/55

bounty

0/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

8 in-scope

4wildcards
3other
1urls

Scope

In scope

008

wildcards04

urls01

+deepwiki.com· high

other03

+Jetbrains IDE Plugin· critical
+Devin CLI· critical
+Devin Desktop· critical

Out of scope

000

none listed

Change history

2 events

in-scope over 76dpeak 8

first indexedscope addedscope removedreward change

2026-10-21
+ added 1 scope · Jetbrains IDE Plugin
− removed 1 scope · Windsurf Plugins
16d ago
2026-08-06
first indexed
92d ago · 8 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Cognition.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": 0,
  "url": "https://hackerone.com/cognition",
  "name": "Cognition",
  "handle": "cognition",
  "targets": {
    "in_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.cognition.ai",
        "eligible_for_bounty": false,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.cognition.com",
        "eligible_for_bounty": false,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.devin.ai",
        "eligible_for_bounty": false,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.windsurf.com",
        "eligible_for_bounty": false,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "Devin CLI",
        "eligible_for_bounty": false,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "We are looking to identify bugs in the IDE which pertain to features which we have implemented. Underlying VSCode vulnerabilities will not be considered valid bugs unless they directly can be used to exploit a feature which we have implemented.",
        "max_severity": "critical",
        "asset_identifier": "Devin Desktop",
        "eligible_for_bounty": false,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "OTHER",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "Jetbrains IDE Plugin",
        "eligible_for_bounty": false,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "high",
        "asset_identifier": "deepwiki.com",
        "eligible_for_bounty": false,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "not_defined"
      }
    ],
    "out_of_scope": []
  },
  "website": "https://cognition.ai",
  "offers_swag": false,
  "managed_program": true,
  "offers_bounties": false,
  "submission_state": "open",
  "allows_bounty_splitting": false,
  "average_time_to_bounty_awarded": null,
  "response_efficiency_percentage": 59,
  "average_time_to_report_resolved": null,
  "average_time_to_first_program_response": 3
}