Does OpenAI have a bug bounty program?

Yes, OpenAI runs a public bug bounty program on Bugcrowd, with rewards up to $30K. It currently lists 12 in-scope assets.

How much does OpenAI pay for bug bounties?

OpenAI's published reward range on Bugcrowd is up to $30K. Actual payouts depend on severity and scope.

Does OpenAI offer safe harbor for security researchers?

Yes, OpenAI publishes a safe-harbor clause protecting good-faith security research conducted within the program's scope and rules.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/Bugcrowd/engagements/openai

OpenAI

Bugcrowd·updated 6h ago·+3−2reward· 7d

bountymanaged

Discord → RSS

max reward: $30K
scope: 12 in · 0 out
safe harbor: partial
response: no reports

open program

signalsreward raised once since Nov 2026derived from our snapshot history

hunt score

$$cashfresh

formula →

payout

36/55

bounty

20/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

12 in-scope

5urls
3other
3apis
1wildcards

Scope

In scope

012

wildcards01

+*.openai.comscope

urls05

apis03

+api.openai.com
+chat.openai.com
+OpenAI API Keys

other03

+ChatGPT Desktop
+Codex CLI
+Other

Out of scope

000

none listed

Change history

3 events

in-scope over 89dpeak 13

first indexedscope addedscope removedreward change

2026-11-03
reward: $6.5K → $30K
+ added 3 scopes · ChatGPT Desktop, Codex CLI, https://chatgpt.com
− removed 2 scopes · Codex Desktop, https://chatgpt.com/dots/
3d ago
2026-10-28
+ added 1 scope · https://chatgpt.com/dots/
9d ago
2026-08-06
first indexed
92d ago · 12 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for OpenAI.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Similar programs

by shared scope

Your notes

▸ raw source payload

{
  "url": "https://bugcrowd.com/engagements/openai",
  "name": "OpenAI",
  "targets": {
    "in_scope": [
      {
        "uri": "https://chatgpt.com",
        "name": "ChatGPT Web",
        "type": "website",
        "target": "https://chatgpt.com",
        "ipAddress": null
      },
      {
        "uri": "https://chat.openai.com",
        "name": "ChatGPT Plugins",
        "type": "api",
        "target": "https://chat.openai.com",
        "ipAddress": ""
      },
      {
        "uri": "https://api.openai.com",
        "name": "api.openai.com",
        "type": "api",
        "target": "https://api.openai.com",
        "ipAddress": ""
      },
      {
        "uri": "https://platform.openai.com/playground",
        "name": "Developer Platform Playground",
        "type": "website",
        "target": "https://platform.openai.com/playground",
        "ipAddress": null
      },
      {
        "uri": null,
        "name": "ChatGPT Desktop",
        "type": "other",
        "target": "ChatGPT Desktop",
        "ipAddress": null
      },
      {
        "uri": "",
        "name": "Codex CLI",
        "type": "other",
        "target": "Codex CLI",
        "ipAddress": ""
      },
      {
        "uri": "https://openai.com/",
        "name": "openai.com",
        "type": "website",
        "target": "https://openai.com/",
        "ipAddress": null
      },
      {
        "uri": "https://*.openai.org",
        "name": "OpenAi Research",
        "type": "website",
        "target": "https://*.openai.org",
        "ipAddress": ""
      },
      {
        "uri": null,
        "name": "*.openai.com",
        "type": "website",
        "target": "*.openai.com",
        "ipAddress": null
      },
      {
        "uri": "",
        "name": "Other",
        "type": "other",
        "target": "Other",
        "ipAddress": ""
      },
      {
        "uri": "",
        "name": "Third Party Targets",
        "type": "website",
        "target": "Third Party Targets",
        "ipAddress": ""
      },
      {
        "uri": "",
        "name": "OpenAI API Keys",
        "type": "api",
        "target": "OpenAI API Keys",
        "ipAddress": ""
      }
    ],
    "out_of_scope": []
  },
  "max_payout": 30000,
  "safe_harbor": "partial",
  "allows_disclosure": false,
  "managed_by_bugcrowd": true
}