Bug bounty program

Keeper Security Public Bounty Program

Open on Bugcrowd Atlas

Platform: Bugcrowd
Bounties: Pays
Assets in scope: 22
Disclosed reports: 0
Subdomains: 184
Vendor on CyberSIXT: Keepersecurity (2 CVEs, 0 exploited)

Most upvoted reports0

No report of this program is publicly disclosed

In scope

APIs7 assetshttps://docs.keeper.io/en/keeperpam/secrets-manager/overview · https://keepersecurity.com/console · https://docs.keeper.io/keeper-bridge/ · https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/gateways · https://docs.keeper.io/sso-connect-cloud/ · https://docs.keeper.io/sso-connect-guide/ · https://docs.keeper.io/en/keeperpam/commander-cli/overview
Other assets6 assetshttps://www.keepersecurity.com/download.html · https://www.keepersecurity.com/download.html · https://docs.keeper.io/kcm · https://www.keepersecurity.com/download.html?t=db · https://www.microsoft.com/en-us/p/keeperchat/9pdqtcpn4kxn#activetab=pivot:overviewtab · https://apps.apple.com/us/app/keeperchat/id1273303729?mt=12
Web applications5 assetshttps://keepersecurity.com/vault · https://keepersecurity.com/password-manager-free-trial.html · https://docs.keeper.io/en/keeperpam · https://keepersecurity.com/console · https://keepersecurity.com
Mobile apps4 assetshttps://www.keepersecurity.com/download.html · https://play.google.com/store/apps/details?id=com.callpod.android_apps.keeper&hl=en_US&gl=US · https://apps.apple.com/app/id1216446440 · https://play.google.com/store/apps/details?id=com.keepersecurity.chat&hl=en_US&gl=US

Subdomains184

Root:keepersecurity.com

Scope

Name suggests:Test and QA

First seen

Text fileClear filters17 names

Subdomains of Keeper Security Public Bounty Program
Name	Scope	First seen
qa.keepersecurity.comtest	Not in the scope	2026-11-14
test.keepersecurity.comtest	Not in the scope	2026-11-14
www.qa.keepersecurity.comtest	Not in the scope	2026-11-14
scim.qa.keepersecurity.comtest	Not in the scope	2026-11-14
admin.qa.keepersecurity.comadmin, test	Not in the scope	2026-11-14
cloud.qa.keepersecurity.comtest	Not in the scope	2026-11-14
krelay.qa.keepersecurity.comtest	Not in the scope	2026-11-14
sso-demo1.keepersecurity.comauth, test	Not in the scope	2026-11-14
sso-demo2.keepersecurity.comauth, test	Not in the scope	2026-11-14
connect.qa.keepersecurity.comtest	Not in the scope	2026-11-14
download.qa.keepersecurity.comtest	Not in the scope	2026-11-14
services.qa.keepersecurity.comtest	Not in the scope	2026-11-14
www.scim.qa.keepersecurity.comtest	Not in the scope	2026-11-14
www.admin.qa.keepersecurity.comadmin, test	Not in the scope	2026-11-14
www.sso-demo1.keepersecurity.comauth, test	Not in the scope	2026-11-14
push.services.qa.keepersecurity.comtest	Not in the scope	2026-11-14
files.services.qa.keepersecurity.comdata, test	Not in the scope	2026-11-14

1 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.