CodeRabbit

Program Details

CodeRabbit covers all internet-facing systems on its own domains, scoring severity on a scale adapted from CVSS 3.0 and paying against it. Reports are acknowledged within three business days and researchers are credited by name on any public disclosure with their permission, but details may not be shared with anyone until CodeRabbit gives written approval.

Allows Disclosure

No

Response SLA

3 business days

Payout Structure

Rules & Testing

Out of Scope

General security, email or SSL/TLS best practices without a working proof of concept, Physical compromise or intrusion, Rate limiting or brute-force issues on unauthenticated endpoints, Compromises involving an insider, Social engineering, including phishing attempts, Reflected file downloads, Account takeover, including brute-force attacks on accounts that are not yours, Red-teaming and adversarial testing of the services, Content issues with the CodeRabbit bot and its responses, Denial-of-service attacks, Clickjacking on pages with no sensitive actions, Missing HttpOnly or Secure flags on cookies, Dependency hijacking, Widely publicised zero-days with no patch, or patched less than 30 days ago

Security

Preferred Languages

English

security.txt

Contact

https://www.coderabbit.ai/vulnerability-disclosure/submit-vulnerability

Policy

https://www.coderabbit.ai/vulnerability-disclosure

Languages

en

Expires

Dec 31, 2027