Help us keep Glitch secure. Find vulnerabilities, report responsibly, get rewarded.
Security is foundational to a self-hosted platform. When users trust Glitch with their home network, we take that responsibility seriously. Our bug bounty program rewards security researchers who help us identify and fix vulnerabilities before they can be exploited. We believe that transparent, community-driven security makes everyone safer.
This is a responsible disclosure program. We ask that you give us a reasonable window to investigate and patch any issue before public disclosure. In return, we commit to acknowledging your report promptly, keeping you informed throughout the fix process, and rewarding your work fairly based on the severity and impact of the finding.
The following components are eligible for bounty rewards:
The following are not eligible for bounty rewards:
| Severity | Reward | Examples |
|---|---|---|
| Critical | $500 – $1,000 | Remote code execution, authentication bypass, server takeover |
| High | $200 – $500 | Privilege escalation, arbitrary file read/write, save state manipulation |
| Medium | $50 – $200 | Cross-site scripting (XSS), CSRF, information disclosure |
| Low | Hall of Fame + Swag | Minor information leaks, verbose error messages, missing headers |
Rewards are determined based on the vulnerability's real-world impact, exploitability, and the quality of your report. Exceptional reports with proof-of-concept code or detailed remediation suggestions may receive bonuses above the listed tiers.
Test against the latest version of Glitch Server running locally. Use your own instance — never test against other people's servers or production infrastructure.
Send a detailed report to security@glitchonline.com. Include steps to reproduce, affected components, potential impact, and any proof-of-concept code or screenshots.
Allow up to 90 days for us to investigate, develop a fix, and release a patch. We'll acknowledge your report within 48 hours and provide regular updates on our progress.
Once the fix is released, you'll receive your bounty reward and be credited in our security advisory and Hall of Fame (unless you prefer to remain anonymous).