Cloudflare opens $3,000 bug bounty program to the public
The company's previous program paid out around $212,000 over its lifetime
 
Cloudflare, a provider of web infrastructure and security services, has announced the launch of its public bug bounty program.
Bug hunters and security researchers can now report vulnerabilities found in Cloudflare products as part of the company's latest program, which is hosted on HackerOne.
A private bounty program was previously launched in 2018, following a vulnerability disclosure program in 2014. The company paid $211,512 in bounties during the lifetime of this program, with 292 out of the 430 reports receiving a reward.
Rewards for Cloudflare's latest program vary with the severity of the vulnerability. Each security flaw is assigned a severity rating based on the Common Vulnerability Scoring Standard (CVSS) version 3.
There is a $3,000 payment for a critical vulnerability report, while high, medium, and low vulnerabilities are worth $1,000, $500, and $250, respectively. However, rewards vary for secondary and other targets.
As a way to make vulnerability research easier, Cloudflare also developed a sandbox called CumulusFire, which provides a standardized playground for researchers to test their exploits. The sandbox will also assist Cloudflare’s security teams in reproducing potential exploits for analysis.
“CumulusFire has already helped us address the constant trickle of reports in which researchers would configure their origin server in an obviously insecure way, beyond default or expected settings, and then report that Cloudflare’s WAF does not block an attack. By policy, we will now only consider WAF bypasses a vulnerability if it is reproducible on CumulusFire,” explained Cloudflare.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
A good place to start is to refer to the documentation on Cloudflare's developer and API portals, the Learning Center, and its support forums.
The firm also aims to add additional documentation, testing platforms, and a way for researchers to interact with its security teams to ensure submissions are valid.
- 
 Manufacturers report millions in losses as downtime wreaks havoc on operations Manufacturers report millions in losses as downtime wreaks havoc on operationsNews UK manufacturers are losing up to £736 million every week due to downtime, according to new research, with outages lasting for several days on end. 
- 
 Microsoft gives OpenAI restructuring plans the green light Microsoft gives OpenAI restructuring plans the green lightNews The deal removes fundraising constraints and modifies Microsoft's rights to use OpenAI models and products 
- 
 Cisco ASA customers urged to take immediate action as NCSC, CISA issue critical vulnerability warnings Cisco ASA customers urged to take immediate action as NCSC, CISA issue critical vulnerability warningsNews Cisco customers are urged to upgrade and secure systems immediately 
- 
 Edge devices are now your weakest link: VPNs, firewalls, and routers were the leading source of initial compromise in 30% of incidents last year – here’s why Edge devices are now your weakest link: VPNs, firewalls, and routers were the leading source of initial compromise in 30% of incidents last year – here’s whyNews Compromised network edge devices have rapidly emerged as one of the biggest attack points for small and medium businesses. 
- 
 Billions of IoT devices will need to be secured in the next four years – zero trust could be the key to success Billions of IoT devices will need to be secured in the next four years – zero trust could be the key to successNews Researchers have warned more than 28 billion IoT devices will need to be secured by 2028 as attacks on connected devices surge. 
- 
 Cisco claims new smart switches provide next-level perimeter defense Cisco claims new smart switches provide next-level perimeter defenseNews Cisco’s ‘security everywhere’ mantra has just taken on new meaning with the launch of a series of smart network switches. 
- 
 Five Eyes cyber agencies issue guidance on edge device vulnerabilities Five Eyes cyber agencies issue guidance on edge device vulnerabilitiesNews Cybersecurity agencies including the NCSC and CISA have issued fresh guidance on edge device security. 
- 
 T-Mobile security chief insists its defenses stood up to attacks linked to Salt Typhoon T-Mobile security chief insists its defenses stood up to attacks linked to Salt TyphoonNews No T-Mobile customers or services were affected after its security teams detected suspicious activity on their routers 
- 
 Securing your network in every direction with zero trust Securing your network in every direction with zero trustWhitepaper Webinar on the evolution of network security 
- 
 Turning your log and incident data into real-time security insights Turning your log and incident data into real-time security insightsWhitepaper Integrate multiple data sources for a comprehensive security view