UPDATED MARCH 31, 2025

Kong Bug Bounty Program

Kong rewards security researchers who help identify and report security vulnerabilities in our products and services through our private, invitation-only bug bounty program hosted on HackerOne.

How to Participate

Our bug bounty program is private and invitation-only. To request an invitation:

Email vulnerability@konghq.com with your:

  • Name and contact information
  • Security research experience
  • HackerOne profile (required)

Program Details

  • In-scope and out-of-scope systems and vulnerabilities are defined within the HackerOne program.
  • Rewards are determined based on the severity and impact of the reported vulnerability.
  • HackerOne triage aims for a two-business-day initial response time
  • Initial response time refers to acknowledgment of the report, after which they begin the validation process (checking scope, removing duplicates, and verifying vulnerabilities)
  • Our security team reviews all valid submissions after triage


If you have any questions regarding the bug bounty program, don't hesitate to get in touch with vulnerability@konghq.com.

Thank you for helping us improve Kong's security.