Skip to content
root-me.cloud
LoginLeaderboard

Find the vulnerabilities that matter.Report them safely.

Organizations publish what they want tested and how they will respond. Researchers report what they find, in private, until it is fixed. root-me.cloud keeps both sides on the same page from first report to public credit.

Find a programLaunch a program
Public programs
11
Reports resolved
0
Hackers thanked
0

Live figures from this platform

Programs open for research

Each program publishes its scope, its rules and how it says thank you. Pick one, read the policy, start testing.

See all programs

  • root-me.cloud

    @root-me

    Vulnerability Disclosure

    Help us keep root-me.cloud safe — report what you find, test responsibly.

    • Full safe harbor
    • Managed
    • Includes retesting
    • Domain2
    • Wildcard1
    • API1

    Thanks + reputation

    Reports resolved
    0
    Hackers thanked
    0
    Response efficiency
    –

  • Parcelo (demo)

    @parcelo-demo

    Vulnerability Disclosure

    Fictional parcel-tracking service — disclosure program focused on account access.

    • Managed
    • Domain1
    • API1
    • Wildcard1
    • URL1

    Thanks + reputation

    Reports resolved
    0
    Hackers thanked
    0
    Response efficiency
    –

  • MediSync (demo)

    @medisync-demo

    Vulnerability Disclosure

    Fictional patient portal — disclosure program focused on record access control.

    • Full safe harbor
    • Managed
    • Includes retesting
    • Domain1
    • API1
    • Wildcard1

    Thanks + reputation

    Reports resolved
    0
    Hackers thanked
    0
    Response efficiency
    –

One place for the whole life of a vulnerability, from report to recognition

Clear rules for researchers, a structured workflow for security teams, and a public record once both sides agree to share it.

Safe harbor

Programs state up front which testing they authorize. Those offering full safe harbor commit not to pursue good-faith research that stays within their policy.

  • Vulnerability disclosure

    A public front door for security reports: a policy, a scope and a promise to respond. Researchers are thanked publicly and earn reputation.

  • Bug bounty

    Programs that pay for valid findings, with a published reward range for every severity so researchers know what a report is worth before they start.

  • Hacktivity

    The public feed of resolved and disclosed reports. Learn from real findings, see how programs respond, and follow the researchers behind them.

  • Reputation & leaderboard

    Every closed report moves your reputation, signal and impact. The leaderboard ranks researchers by what they actually got fixed.

How it works

The same six steps for every report, whether it earns a bounty or a thank-you.

Read the disclosure guidelines

  1. Step 1: Find a program

    Browse the programs and pick a target whose scope matches your skills.

  2. Step 2: Read the policy

    Scope, exclusions and rules of engagement say what you may test and how. Stay inside them.

  3. Step 3: Submit a report

    Describe the issue, the steps to reproduce it and its impact. It stays private between you and the program team.

  4. Step 4: Triage

    The team validates the finding, rates its severity and keeps you informed in the report thread.

  5. Step 5: Fix

    The organization ships a fix and closes the report as resolved. Your reputation is updated.

  6. Step 6: Disclose and get credit

    Either side can ask to disclose the closed report. Once the other agrees, it goes public on Hacktivity.

Ready to look for something that matters?

Start with a program’s policy, report what you find, and build a public track record one fix at a time.

Create an accountRun a program