
Django
External Program
Submit bugs directly to this organization
Django is used to power some of the most important sites on the web and its increasing popularity has made it a critical piece of internet infrastructure. If you’ve found a security bug that could potentially impact the security of these sites, you have our thanks and might be eligible for a cash reward.
YOU MAY NOT TEST AGAINST SERVERS YOU DO NOT HAVE EXPLICIT PERMISSION TO TEST. YOU DO NOT HAVE PERMISSION TO SCAN THE DJANGOPROJECT.COM SERVERS.
IF YOU TEST AGAINST THE DJANGOPROJECT.COM SERVERS, YOU WILL NOT BE REWARDED ANY BOUNTY.
The Django team reserves the right to make the final call on the severity for any issue, but to give you an idea of our priorities, here are some rough ranges, and the types of issues we expect would fall into each range:
Severe issues
Moderate issues
Low severity issues
No Reward
The Internet Bug Bounty awards security research on Django. If your vulnerability meets the eligibility criteria, you can submit the post-fix information to the IBB for payout. As the IBB supports the whole vulnerability lifecycle, these bounty awards are awarded as an 80/20 split, where 80% will go to you, the finder, and 20% will be given to the Django Software Foundation (https://www.djangoproject.com/foundation/) to continue to support the vulnerability remediation efforts.
To submit eligible vulnerabilities for a payout go to https://hackerone.com/ibb for submission instructions after the project maintainers have resolved the vulnerability.
The project maintainers have final decision on which issues constitute security vulnerabilities. The IBB team will respect their decision, and we ask that you do as well.