Does Semrush have a bug bounty program?

Yes, Semrush runs a public bug bounty program on HackerOne. It currently lists 14 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackerOne/semrush

Semrush

HackerOne·updated 8h ago

bountyswagopen

Discord → RSS

payout: no bounty
scope: 14 in · 2 out
safe harbor: unknown
response: no reports

open program

hunt score

cashfresh

formula →

payout

0/55

bounty

20/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

14 in-scope

9wildcards
3urls
2other

Scope

In scope

014

wildcards09

urls03

other02

+Leaked/Сompromised Employee accounts· medium
+Other Semrush Related Asset· critical

Out of scope

002

−advocates.semrush.comurl
−email.semrush.comurl

Change history

2 events

in-scope over 33dpeak 14

first indexedscope addedscope removedreward change

2026-09-08
+ added 1 scope · www.semrush.com
59d ago
2026-08-06
first indexed
92d ago · 13 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Semrush.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": 0,
  "url": "https://hackerone.com/semrush",
  "name": "Semrush",
  "handle": "semrush",
  "targets": {
    "in_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": "Registration is stopped at the moment. ",
        "max_severity": "high",
        "asset_identifier": "*.berush.com",
        "eligible_for_bounty": false,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "high",
        "asset_identifier": "*.myinsights.io",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.prowly.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "high",
        "asset_identifier": "*.scatec.io",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "low"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "medium",
        "asset_identifier": "*.sellzone.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "low"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.semrush.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.semrush.net",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "high",
        "asset_identifier": "*.seoab.io",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "high",
        "asset_identifier": "*.seoquake.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "low"
      },
      {
        "asset_type": "OTHER",
        "instruction": "Please review the program policy on this scope before submitting your report. ",
        "max_severity": "medium",
        "asset_identifier": "Leaked/Сompromised Employee accounts",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": "Please use this Asset tag for any High and Critical report that does not relate directly to another Semrush asset listed in scope, and is also NOT listed under the \"Out of Scope\" section.\nPlease note, that Semrush will only accept and review valid high and critical severity reports.",
        "max_severity": "critical",
        "asset_identifier": "Other Semrush Related Asset",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "medium",
        "asset_identifier": "investors.semrush.com",
        "eligible_for_bounty": false,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "low"
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "medium",
        "asset_identifier": "workflows.semrush.com",
        "eligible_for_bounty": false,
        "integrity_requirement": "low",
        "eligible_for_submission": true,
        "availability_requirement": "low",
        "confidentiality_requirement": "low"
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "www.semrush.com",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "none",
        "asset_identifier": "advocates.semrush.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "none",
        "asset_identifier": "email.semrush.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ]
  },
  "website": "https://www.semrush.com/",
  "offers_swag": true,
  "managed_program": false,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 160,
  "response_efficiency_percentage": 99,
  "average_time_to_report_resolved": 871,
  "average_time_to_first_program_response": 5
}