MO
HackerOneOffers Rewards
Mongodb
Mongodb appears to run a bug bounty or vulnerability disclosure program on HackerOne. It also offers rewards for valid security reports.
Created: February 15, 2026
Last Updated: October 5, 2026
In Scope (30)
*.mongodb.com/* ( [Non-Core]
.mongodb.com/ is in scope, and includes
mongodb.com/docs/
support.mongodb.com
All others sites that follow that pattern are in-scope. If the site is owned by MongoDB, it is eligible for a bounty. If it’s owned by a 3rd party, it is not eligible for a bounty. This scope is a catch-all for all products not listed individually with the 'Atlas' Prefix, or covered as an Atlas product, listed elsewhere in the scope.
mongodb.com/community/forums is in scope, but not eligible for a bounty.
feedback.mongodb.com is out of scope and not eligible for bounty. Please do not test that platform. All bugs should be reported to AHA, not MongoDB.
Artifactory is being deprecated and not eligible for bounty. )
App Services/Realm ( MongoDB App Services (fka Realm) has been deprecated. )
Atlas Charts ( [Core]
charts.mongodb.com )
Atlas Data Federation ( [Core]
Atlas Data Federation is embedded into the Atlas Platform. Read more here:
https://www.mongodb.com/products/platform/atlas-data-federation )
Atlas IAM ( [Core]
account.mongodb.com and other Identity and Access Management bugs within Atlas, regarding Organizations, Projects and permissions. )
Atlas Infinite ( [Core]
https://www.mongodb.com/docs/atlas/infinite/atlas-infinite-landing/ )
Atlas Payments/Billing ( [Core]
Billing is integrated into the Atlas Platform, read more here: https://www.mongodb.com/docs/atlas/billing/ )
Cluster-To-Cluster sync ( [Non-Core]
https://www.mongodb.com/try/download/mongosync )
Compass ( [Non-Core]
https://www.mongodb.com/try/download/compass
Responsible social engineering reports are in scope but not eligible for bounty. )
Database Tools ( [Non-Core]
https://www.mongodb.com/try/download/database-tools )
Drivers ( [Non-Core]
These are the following drivers that are in scope:
Atlas SQL JDBC Driver
Atlas SQL ODBC Driver
C
C++
Go
JVM (Java, Scala, Kotlin)
Libmongocrypt
Node.js/Typescript
PHP
Python
Ruby
Rust
The Swift Driver is not in scope and not eligible for bounty. )
Enterprise Edition Products and Tools ( [Core]
Ops manager and Cloud manager )
Evergreen ( [Non-Core]
https://github.com/evergreen-ci/evergreen )
Jira Projects ( [Non-Core]
MongoDB is open-sourced and has publicly visible JIRA tickets. Only report information disclosure issues-- no technical bugs are accepted. Bounty may be varied. )
MongoDB Assistant ( [Non-Core]
MongoDB Assistant is integrated into Data Explorer and Compass. )
MongoDB Atlas ( [Core]
Atlas and Atlas Features and Products are in scope and eligible for bounty.
Atlas IAM, Charts, Data Federation, Payments/Billing, are listed elsewhere in the scope. Other Atlas products not explicitly listed elsewhere in the scope should be submitted here. This includes, but is not limited to Streams, Online Archive, Clusters, and Backup.
https://cloud.mongodb.com )
MongoDB Atlas Agent Engine ( [Core]
https://www.mongodb.com/docs/agentengine/
Customers are responsible for the correct functioning of their MongoDB-hosted agent, so no bug reports will be accepted for misbehaving agents. Bug reports will also not be accepted for agents that violate our Acceptable Use Policy or Terms of Service. Otherwise, security gaps in the Atlas Agent Engine control plane or data plane, especially where cross-customer data access or availability impacts are possible, should be reported. )
MongoDB Atlas Agent Engine CLI and First Party Libraries ( [Non-Core]
Responsible social engineering reports are in scope but not eligible for bounty. )
MongoDB Connectors ( [Non-Core]
The Connectors are in scope. This includes
Kafka Connector
PowerBI Connector
BI Connector
Spark Connector
Tableau Connector )
MongoDB IntelliJ Plugin ( [Non-Core]
https://plugins.jetbrains.com/plugin/24377-mongodb )
MongoDB MCP Server ( [Non-Core]
https://github.com/mongodb-js/mongodb-mcp-server )
MongoDB Owned GitHub Repositories ( [Non-Core]
Only github.com/mongodb is considered to be eligible for bounty. Other MongoDB owned repositories are in scope, but not eligible for bounty.
https://github.com/mongodb/kingfisher is out of scope and not eligible for bounty. )
MongoDB Partner Integrations ( [Non-Core]
https://cloud.mongodb.com/ecosystem
Partner integrations may be eligible for bounties, depending on the owner of the issue. )
MongoDB Server ( [Core]
Server Community and Server Enterprise are in scope and eligible for bounty. )
MongoDB Shell ( [Non-Core]
https://www.mongodb.com/try/download/shell )
MongoDB Toolchain ( [Non-Core]
http://mongodbtoolchain.build.10gen.cc )
Relational Migrator ( [Non-Core]
https://www.mongodb.com/try/download/relational-migrator )
University Platform ( [Non-Core]
learn.mongodb.com is owned by 3rd party and not eligible for bounty )
VS Code Plugin ( [Non-Core]
https://marketplace.visualstudio.com/items?itemName=mongodb.mongodb-vscode )
voyageai.com ( [Non-Core]
https://www.voyageai.com
https://ai.mongodb.com
https://api.voyageai.com
https://blog.voyageai.com/
https://docs.voyageai.com/docs/introduction )
Out of Scope (0)
No out-of-scope items specified