CodeRabbit is one of the highest-paying direct bug bounty programs in the Web2 space right now, with rewards from $100 up to $20,000. It’s an AI code review tool that plugs into GitHub and GitLab, which means it touches other companies’ source code — and companies that handle other people’s code tend to take vulnerabilities seriously. That’s exactly why this program is worth your time.
Program Overview
The published reward range is $100–$20,000, depending on severity. That top end puts CodeRabbit in the same conversation as programs on HackerOne’s public leaderboard — except this one runs directly with the company, no platform cut, no invite wall.
| Detail | Value |
|---|---|
| Reward range | $100 – $20,000 |
| Policy | coderabbit.ai/vulnerability-disclosure |
| Submission | Web form at coderabbit.ai/vulnerability-disclosure/submit-vulnerability |
| Type | Direct company program |
Everything goes through their vulnerability disclosure page, so read the full policy before you send anything. The submission form is a plain web form — no account creation gate at the time of writing, but check the page since direct programs change process details more often than platform ones.
Attack Surface: Where the Real Bugs Live
CodeRabbit’s product is an integration, and integrations are where logical vulnerabilities hide. Think through what the product actually does: it receives webhooks from GitHub and GitLab, clones or reads repository content, sends that content through an AI pipeline, and posts comments back. Each hop is a trust boundary.
Reasonable areas to examine:
- Webhook handling. Can you trigger a webhook event the app accepts without proper signature verification? Webhook forgery is a classic high-severity find in any GitHub-integrated product.
- OAuth and app installations. What happens between organizations? If repo A’s data can surface in a context belonging to org B, that’s cross-tenant leakage — usually critical.
- The review comments themselves. AI-generated comments are rendered in GitHub/GitLab UIs. If attacker-controlled content (a malicious filename, a crafted diff, a commit message) can inject HTML or markdown that executes in a reviewer’s browser, you have stored XSS on a third-party platform.
- Repository content exfiltration. Prompt-driven pipelines that read code can sometimes be steered into leaking content across reviews. A malicious repo that causes the pipeline to emit another customer’s code is a top-tier report.
- The dashboard and API. Session handling, API key scope, and authorization on org-level endpoints. Standard IDOR checks apply — test whether object IDs are properly tenant-scoped.
You don’t need to hit all of these. One well-argued report on a trust boundary beats ten scanner dumps.
Beginner Mistakes That Get Reports Rejected
1. Testing against your employer’s repos or shared infrastructure. Register a throwaway GitHub org you own. Never run tests that touch repositories you don’t own.
2. Reporting the AI saying something wrong. “The AI gave incorrect advice” is not a security vulnerability. It becomes one only when incorrect output creates a concrete security impact — that distinction should be in your report explicitly.
3. Ignoring the disclosure policy’s exclusions. Direct programs typically exclude things like self-XSS, missing security headers, and rate limiting. Spending two days on an excluded class is the most common way beginners burn motivation.
4. Writing a wall of text with no impact statement. Lead with: what the bug is, where it lives, what an attacker gains, and minimal reproduction steps. Attach a working PoC. Reviewers triage dozens of reports; clarity is leverage.
5. Retesting destructive payloads on production. Anything that could alter other users’ data, spam real repositories, or hammer their API is out of bounds. Demonstrate impact with a harmless payload on assets you control.
Why This Program Suits Newer Hunters
Direct programs like this one have a signal-to-noise advantage: fewer hunters know they exist, and the company reads reports directly instead of filtering through a triage queue. The $20,000 ceiling means a single solid critical finding on a trust boundary can outearn months of low-tier finds on crowded platforms.
That said, you still need targets. Half the battle in Web2 hunting is knowing which companies run direct programs, what they pay, and where to submit — most of these programs have zero marketing behind them.
Next Step
If you want a full pipeline of programs like this — 51 verified direct and platform targets with reward ranges, contact channels, and policy links in CSV/JSON — check out the Web2 Bug Bounty Targets Database. It’s the fastest way to stop scraping Reddit threads for leads and start submitting.