CloudCannon Bug Bounty

Welcome to CloudCannon's bug bounty programme. If you believe you've found a critical vulnerability please follow the steps below and create a bug report. While we appreciate all submissions, only critical bugs are within scope.

Submission Process

  • looks_one Check Scope

    Confirm the bug fits within the scope defined in the Bug Bounty Policy

  • looks_two Submit Report

    Submit your report which includes clear, concise and reproducible steps to replicate the issue.

  • looks_3 Confirmation

    The CloudCannon support team will make contact within five working days to acknowledge we have received your report.

  • looks_4 Assessment & Rewards

    CloudCannon will assess the report and will offer a reward based on severity and current scope.


Only the CloudCannon app ( is within scope. Other sub-domains will not be considered for bug bounties. At this stage we will only be assessing critical vulnerabilities.


CloudCannon will award valid reports based on the scope and severity of each report. Monetary rewards are paid by TransferWise Bank transactions only. Any charges incurred for TransferWise transactions will not be covered by CloudCannon.

Scope Severity Bounty Reward Critical Yes $50 - $100 USD Moderate Yes $20 - $50 USD

Bug Bounty Policy

Bounty Qualification

Only critical vulnerabilities that demonstrate complete compromise of the system's integrity or confidentiality are eligible for a bounty. While we encourage you to submit all potential issues, lower severity issues are not in scope at this time.

It's important to keep in mind that not all submissions will qualify for a bounty, and that the decision to award a bounty is entirely at the discretion of CloudCannon. CloudCannon have the final decision on which issues constitute security vulnerabilities.

Disclosure Policy


  • Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Making many substantially similar reports will only be eligible for one bounty award, and marked as duplicate. For example, the same vulnerability reported across multiple sub-domains. Please consolidate issues into a single report.


  • Do not make any information public until the issue has been resolved.
  • Do not access or modify data that does not belong to you - create a free account to test with.


While researching, we'd like to ask you to refrain from:

  • Denial of service
  • Spamming
  • Social engineering (including phishing) of CloudCannon staff or contractors
  • Any physical attempts against CloudCannon property or data centers

We do not cover TransferWise fees for international transactions, credit card transactions or any other services. TransferWise may deduct this from the amount sent to the payee.

Safe Harbour

Any activities conducted in a manner consistent with this policy will be considered authorised conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping to keep CloudCannon and our users safe!

Submit Report

Please provide as much information as possible about the potential issue you have discovered. The more information you provide, the faster CloudCannon will be able to validate the issue. 

Submissions have been disabled while we work through outstanding reports. Any submissions made will not be acknowledged until we re-enable this form.

Join thousands of developers building sites on CloudCannon today

Get started free