Changes to the TYPO3 Bug Bounty Program

• Financial rewards for extension vulnerability reports end on 31 May 2026.
• Reports submitted before 31 May 2026 are still eligible under the current terms.
• Extension security reporting remains open — the TYPO3 Security Team continues to review, coordinate, and publish advisories.
• The Bug Bounty Program continues for Core, infrastructure, and server.

As vulnerability reporting practices evolve across the open-source ecosystem, the TYPO3 Security Team is refining the scope of its Bug Bounty Program. Going forward, financial rewards will be limited to findings in TYPO3 Core and infrastructure — the areas centrally maintained and with the highest system-wide impact.

The TYPO3 extension ecosystem is large and diverse, and the quality and maintenance level of individual extensions varies considerably. As reporting volumes have grown, sustaining meaningful review capacity across third-party extensions — each with its own maintainer — has become increasingly difficult to reconcile with the time and focus that Core security demands.

A security process is only effective when reports can be reviewed thoroughly, prioritized correctly, and addressed where they matter most. Concentrating the reward program on Core and infrastructure reflects that commitment.

✅ Extension vulnerability reporting via the Responsible Disclosure process

✅ Security Team review, coordination with maintainers, and security advisories

✅ Bug Bounty rewards for Core, infrastructure, and server findings

❌ Financial rewards for extension vulnerability reports after 31 May 2026

If you've been contributing extension findings, your skills and attention to detail are genuinely valued. TYPO3 Core is where that energy has the broadest reach — every finding affects every installation in the ecosystem, and the Bug Bounty Program remains fully in place there. If you haven't looked at Core security yet, now is a good time to start.

Further details on the scope and process are available here.

Questions? Reach out at security@typo3.org.