Port Swigger bug bounty program
Summary: PortSwigger announced a bug bounty program for Burp Suite, managed on HackerOne with all reports submitted through that platform. The policy puts subdomains like support.portswigger.net strictly out of scope, forbids testing them, and asks researchers to use their own private Collaborator server for Collaborator testing.
Key Takeaway: The program treats the system Burp runs on and everything that can reach the Proxy listener as trusted, so the vulnerabilities that count are those where a website reads files off the user's machine, pulls data out of Burp, or achieves remote code execution - the same trust boundary your analysts rely on when they proxy hostile traffic.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026