Policy and restrictions
Scope includes selected application, API, SDK and supporting services. Unlisted properties, third-party integrations, support interfaces, non-SDK repositories, scan-only results, low-impact findings, denial-of-service and social engineering are excluded. Protect other users’ data and service stability. Public disclosure is prohibited; safe harbor is conditional.
Eligibility and submission status
The June 3, 2026 announcement makes participation public without invitations. Accounts must follow researcher identification rules. Reports require original human analysis and reproducible security impact. Platform reward eligibility includes first valid reporting and applicable adulthood requirements.
Official brief displays In progress, an ongoing period and a Submit report link. Individual eligibility still depends on live terms.
Advertised rewards
Advertised schedule: P4 $150, P3 $1,250, P2 $2,500 and P1 $6,500–$7,500. Severity uses CVSS with impact/likelihood adjustments and an appeal opportunity. These are guidelines, not actual individual awards.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
app.launchdarkly.com | website | In Scope |
events.launchdarkly.com | website | In Scope |
stream.launchdarkly.com | website | In Scope |
LaunchDarkly Open Source SDKs | other | In Scope |
docs.launchdarkly.com | website | In Scope |
https://launchdarkly.com/docs | website | In Scope |
| Asset | Type | Group / eligibility |
|---|---|---|
blog.launchdarkly.com | other | Out of Scope |
launchdarkly.com | other | Out of Scope |
sandbox.launchdarkly.com | other | Out of Scope |
slack.launchdarkly.com | other | Out of Scope |
status.launchdarkly.com | other | Out of Scope |
launchdarkly.atlassian.netPublished location: https://launchdarkly.atlassian.net | other | Out of Scope |
Review limitations
- Brief displays August 13, 2026 as its update date.
- The brief permits certain researcher-identifying email alternatives, while the displayed June 24, 2026 announcement requires the platform email alias exclusively. This inconsistency needs program clarification; no broader permission is inferred.
- USD normalization relies on Bugcrowd accounting documentation because the brief uses dollar signs.
- The page and its displayed announcements were read in the cloud browser; linked announcement archives and authenticated submission flow were not reviewed. This summary omits asset inventories and grants no testing permission.
Sources and provenance
- LaunchDarkly public program brief LaunchDarkly / Bugcrowd · reviewed 2026-10-02
- Bugcrowd Organization Accounting Bugcrowd · reviewed 2026-10-02
- Bugcrowd Standard Disclosure Terms Bugcrowd · reviewed 2026-10-02
- Published Bugcrowd scope groups LaunchDarkly · reviewed 2026-10-03
Record reviewed 2026-10-02. Snapshot 53796974ace8. Open the complete JSON contract.