Ably is a realtime infrastructure platform — pub/sub messaging, live data channels, and websockets at scale, powering everything from sports score apps to delivery tracking. Their disclosure program pays $150 to $5,000, and because the product is API-first, the attack surface rewards hunters who understand auth and protocols rather than those who run scanners.
Program Overview
| Detail | Value |
|---|---|
| Reward range | $150 – $5,000 |
| Policy | ably.com/disclosure |
| Submission | Email: disclosure@ably.com |
| Type | Direct company program |
The policy page spells out scope and rules. Read it end to end before testing — realtime platforms run a lot of shared infrastructure, and the exclusions matter more here than on a typical SaaS marketing site.
Attack Surface: Where a Realtime Platform Is Vulnerable
Infra products are different from consumer apps. Nobody’s uploading an avatar; instead, everything is channels, tokens, and permissions. That’s where the money is:
- Token and capability misconfiguration. Ably uses capability-based auth with tokens scoped to channels and operations. If the Ably TokenRequest or token issuance flow in their own apps (dashboards, demos, examples) can be manipulated to escalate channel permissions, that’s a strong report.
- Channel namespace isolation. Ably separates channels into namespaces like
public,private, andcontrolwith distinct permission rules. Cross-namespace access — reading or publishing on a channel your credentials shouldn’t reach — is exactly the bug class this architecture exists to prevent, which is why a break is valuable. - Channel name collisions and wildcards. Channel names with unusual characters, wildcards in capability strings, or names that resolve across tenant boundaries can produce subtle authorization bypasses. Unicode and emoji channel names are documented as valid — good hunting ground for parsing edge cases.
- Dashboard and account API. The account dashboard controls API keys, usage limits, and billing. IDOR on account objects, weak API key rotation, or missing authorization on org-level settings are classic P1/P2 finds.
- Presence and message history leaks. If presence data or message history on a private channel is retrievable without the right capability, that’s a privacy incident for their customers.
Beginner Mistakes to Avoid
1. Load-testing or flooding channels. This is the fastest way to get banned from an infra program. Ably’s whole product is message delivery; anything resembling a DoS test, message spam, or channel flooding is explicitly destructive. Demonstrate impact with one message, not ten thousand.
2. Testing on other customers’ channels. Create your own account, your own app, your own channels. Any test that touches a channel name you didn’t create risks reading real user data — which turns your bug report into an incident.
3. Sending protocol-level fuzzing output raw. A garbled websocket fuzz log with “crashed?” in the subject is a rejection magnet. If you find malformed-frame handling issues, reproduce them cleanly and explain the impact in plain language.
4. Ignoring the free tier limits. Sign up, stay within normal usage, and keep request volume human. Automated scanning of api.ably.com at scanner speed burns goodwill and usually violates the policy’s testing rules.
5. Reporting informational findings as vulnerabilities. Missing security headers on the marketing site, cookie flags on non-sensitive cookies, or “the API returns verbose errors” are not $150–$5,000 findings here. Match your report to the severity ladder or don’t submit.
Why Ably Rewards Patient, Technical Hunters
The $5,000 ceiling sits at the top of the mid-market range, and the surface — auth logic, capability scoping, tenant isolation — is exactly the kind of work that’s under-supplied. Most hunters grep for XSS in HTML; far fewer sit down with a token and a channel list and map out what they can reach that they shouldn’t. The latter approach is what gets paid here.
Next Step
Ably is one of 51 verified programs in the Web2 Bug Bounty Targets Database — reward ranges, submission contacts, and policy links in CSV/JSON so you can filter by payout and start hunting the same day.