Ably

Program Details

Ably runs its own disclosure programme covering its website, ancillary *.ably.com sites and the production realtime and REST endpoints. Rewards start from a CVSS-informed severity assessment and can be paid to charity instead of the researcher. Only the first responsible disclosure of an issue is eligible, and reports generated solely by AI are not accepted.

Allows Disclosure: Yes

Payout Structure

Critical USD $5,000

High USD $1,500

Medium USD $500

Low USD $150

Rules & Testing

Excluded Methods

DosPhishingPhysical Access

Scope (7 targets)

ably.com web
*.ably.com web
main.realtime.ably.net api
*.realtime.ably.net api
realtime.ably.io api
rest.ably.io api
Ably service endpoints served from customer domains via CNAME api

Out of Scope

Ably subdomains served by third parties, such as support.ably.com, Domains and services that are not customer facing, Third-party functionality surfaced on the website, such as interactive support chat, Reports relating to ably-cli, Username enumeration, Missing rate limits that do not signify a security issue, Security header configuration and missing headers, TLS configuration and known protocol, ciphersuite or certificate weaknesses, SPF, DKIM and DMARC configuration suggestions, Known vulnerable libraries without a working proof of concept

Recognition

Hall of Fame: https://ably.com/acknowledgements

Security

Preferred Languages: English

security.txt

Contact: [email protected]
Policy: https://ably.com/disclosure
Hiring: https://ably.com/careers
Acknowledgments: https://ably.com/acknowledgements
Languages: en
Expires: May 1, 2027

View raw security.txt →