Vulnerability Disclosure Program (VDP)

VDPs are meant for responsibly reporting vulnerabilities you encounter — not for actively hunting for fame or reputation. Even if you're just starting out, consider focusing on rewarded bug bounty programs instead.

cognition

HackerOneView on HackerOne

RawAI Enhanced

In Scope

Out of Scope

In-Scope Assets (6)

Asset	Category	Bounty	Quick Links
*.devin.ai	WILDCARD	No	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
Windsurf IDE	OTHER	No	-
Windsurf Plugins	OTHER	No	-
cognition.ai	URL	No	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
deepwiki.com	URL	No	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa
http://windsurf.com	URL	No	crt.sh Google Shodan SecurityTrails Wayback DNSdumpster VirusTotal AlienVault OTX GitHub Fofa

Scope Changes (12)

May 26, 2026

Change	Asset	Category	Scope	Time
Added	windsurf ide	OTHER	In Scope	14:28
Added	windsurf plugins	OTHER	In Scope	14:28
Added	http://windsurf.com	URL	In Scope	14:28
Added	cognition.ai	URL	In Scope	14:28
Added	*.devin.ai	WILDCARD	In Scope	14:28
Added	deepwiki.com	URL	In Scope	14:28
Added	windsurf ide	OTHER	In Scope	14:28
Added	windsurf plugins	OTHER	In Scope	14:28
Added	http://windsurf.com	URL	In Scope	14:28
Added	cognition.ai	URL	In Scope	14:28
Added	*.devin.ai	WILDCARD	In Scope	14:28
Added	deepwiki.com	URL	In Scope	14:28