Program Removed
This program is no longer available on YesWeHack. The scope data shown below is historical and may not reflect the final state of the program.
bind-bug-bounty-program
3
In Scope
26
Out of Scope
In-Scope Assets (3)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| https://gitlab.isc.org/isc-projects/bind9 | OPEN-SOURCE | Yes | - | |
| https://gitlab.isc.org/isc-projects/bind9 | URL | Yes | ||
| https://gitlab.isc.org/isc-projects/bind9 | CODE | Yes | - |
Out-of-Scope Assets (26)
| Asset | Category | Bounty | |
|---|---|---|---|
| - any asset that is not explicitly included in our program's scope | OTHER | Yes | |
| - any deprecated versions and versions other than the current stable/official version | OTHER | Yes | |
| - any local implementation of the project/implementation belonging to third parties | OTHER | Yes | |
| - any third parties' or community assets (e.g. packages or versions not created and published by isc) | OTHER | Yes | |
| - any vulnerability that requires admin or admin-like access (see above for more details) — this includes access to files on disk, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk, and authenticated access to change the zone file contents (zone transfers, dns update) | OTHER | Yes | |
| - gitlab.isc.org | OTHER | Yes | |
| - lists.isc.org | OTHER | Yes | |
| - vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Yes | |
| any asset that is not explicitly included in our program's scope | OTHER | Yes | |
| any asset that is not explicitly included in our program's scope | OTHER | Yes | |
| any deprecated versions and versions other than the current stable/official version | OTHER | Yes | |
| any depreciated versions and other versions than the current stable/official version are considered out of scope | OTHER | Yes | |
| any local implementation of the project/implementation belonging to third parties | OTHER | Yes | |
| any local implementation of the project/implementation belonging to third parties | OTHER | Yes | |
| any third parties' or community assets (e.g. packages or versions not created and published by isc) | OTHER | Yes | |
| any third parties’ or community’s assets (e.g. packages or versions not created and published by isc) | OTHER | Yes | |
| any vulnerability that requires admin or admin-like access (see above for more details) — this includes access to files on disk, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk, and authenticated access to change the zone file contents (zone transfers, dns update) | OTHER | Yes | |
| any vulnerability that requires admin or admin-like access (see below for more details) - this includes access to files on drive, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk and authenticated access to change the zone file contents (zone transfers, dns update) | OTHER | Yes | |
| gitlab.isc.org | OTHER | Yes | |
| gitlab.isc.org | OTHER | No | |
| gitlab.isc.org | URL | Yes | |
| lists.isc.org | URL | Yes | |
| lists.isc.org | OTHER | No | |
| lists.isc.org | OTHER | Yes | |
| vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Yes | |
| vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Yes |
Scope Changes (63)
Aug 27, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Program Removed | — | — | — | 18:47 |
Aug 12, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | - any local implementation of the project/implementation belonging to third parties | OTHER | Out of Scope | 10:47 |
| Added | https://gitlab.isc.org/isc-projects/bind9 | CODE | In Scope | 10:47 |
| Added | - lists.isc.org | OTHER | Out of Scope | 10:47 |
| Added | - any asset that is not explicitly included in our program's scope | OTHER | Out of Scope | 10:47 |
| Added | - vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Out of Scope | 10:47 |
| Added | - any vulnerability that requires admin or admin-like access (see above for more details) — this includes access to files on disk, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk, and authenticated access to change the zone file contents (zone transfers, dns update) | OTHER | Out of Scope | 10:47 |
| Added | https://gitlab.isc.org/isc-projects/bind9 | OPEN-SOURCE | In Scope | 10:47 |
| Added | - gitlab.isc.org | OTHER | Out of Scope | 10:47 |
| Added | - lists.isc.org | OTHER | Out of Scope | 10:47 |
| Added | - any asset that is not explicitly included in our program's scope | OTHER | Out of Scope | 10:47 |
| Added | - any third parties' or community assets (e.g. packages or versions not created and published by isc) | OTHER | Out of Scope | 10:47 |
| Added | - any deprecated versions and versions other than the current stable/official version | OTHER | Out of Scope | 10:47 |
| Added | - any local implementation of the project/implementation belonging to third parties | OTHER | Out of Scope | 10:47 |
| Added | - vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Out of Scope | 10:47 |
| Added | - any vulnerability that requires admin or admin-like access (see above for more details) — this includes access to files on disk, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk, and authenticated access to change the zone file contents (zone transfers, dns update) | OTHER | Out of Scope | 10:47 |
| Added | - gitlab.isc.org | OTHER | Out of Scope | 10:47 |
| Added | - any deprecated versions and versions other than the current stable/official version | OTHER | Out of Scope | 10:47 |
| Added | - any third parties' or community assets (e.g. packages or versions not created and published by isc) | OTHER | Out of Scope | 10:47 |
Apr 10, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Program Removed | — | — | — | 14:21 |
Apr 7, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | any vulnerability that requires admin or admin-like access (see below for more details) - this includes access to files on drive, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk and authenticated access to change the zone file contents (zone transfers, dns update). | OTHER | Out of Scope | 08:21 |
| Removed | any vulnerability that requires admin or admin-like access (see below for more details) - this includes access to files on drive, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk and authenticated access to change the zone file contents (zone transfers, dns update). | OTHER | Out of Scope | 08:21 |
| Added | any vulnerability that requires admin or admin-like access (see below for more details) - this includes access to files on drive, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk and authenticated access to change the zone file contents (zone transfers, dns update). | OTHER | Out of Scope | 07:21 |
| Added | any vulnerability that requires admin or admin-like access (see below for more details) - this includes access to files on drive, administrative interfaces (rndc, statistics channel), access to any shared key, privileges to write files on disk and authenticated access to change the zone file contents (zone transfers, dns update). | OTHER | Out of Scope | 07:21 |
Mar 26, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Removed | any third parties’ or community’s assets (e.g. packages or versions not created and published by isc) | OTHER | Out of Scope | 16:06 |
| Removed | any depreciated versions and other versions than the current stable/official version are considered out of scope | OTHER | Out of Scope | 16:06 |
| Removed | any local implementation of the project/implementation belonging to third parties | OTHER | Out of Scope | 16:06 |
| Removed | vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Out of Scope | 16:06 |
| Removed | https://gitlab.isc.org/isc-projects/bind9 | URL | In Scope | 16:06 |
| Removed | gitlab.isc.org | URL | Out of Scope | 16:06 |
| Removed | lists.isc.org | URL | Out of Scope | 16:06 |
| Removed | any asset that is not explicitly included in our program's scope | OTHER | Out of Scope | 16:06 |
Feb 25, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Out of Scope | 19:08 |
| Added | https://gitlab.isc.org/isc-projects/bind9 | URL | In Scope | 19:08 |
| Added | gitlab.isc.org | URL | Out of Scope | 19:08 |
| Added | lists.isc.org | URL | Out of Scope | 19:08 |
| Added | any asset that is not explicitly included in our program's scope | OTHER | Out of Scope | 19:08 |
| Added | any third parties’ or community’s assets (e.g. packages or versions not created and published by isc) | OTHER | Out of Scope | 19:08 |
| Added | any depreciated versions and other versions than the current stable/official version are considered out of scope | OTHER | Out of Scope | 19:08 |
| Added | any local implementation of the project/implementation belonging to third parties | OTHER | Out of Scope | 19:08 |
Feb 22, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | any asset that is not explicitly included in our program's scope | OTHER | Out of Scope | 00:51 |
| Added | any third parties’ or community’s assets (e.g. packages or versions not created and published by isc) | OTHER | Out of Scope | 00:51 |
| Added | any depreciated versions and other versions than the current stable/official version are considered out of scope | OTHER | Out of Scope | 00:51 |
| Added | any local implementation of the project/implementation belonging to third parties | OTHER | Out of Scope | 00:51 |
| Added | vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Out of Scope | 00:51 |
| Added | https://gitlab.isc.org/isc-projects/bind9 | CODE | In Scope | 00:51 |
| Added | gitlab.isc.org | URL | Out of Scope | 00:51 |
| Added | lists.isc.org | URL | Out of Scope | 00:51 |
Feb 21, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Removed | https://gitlab.isc.org/isc-projects/bind9 | OPEN-SOURCE | In Scope | 21:40 |
| Removed | gitlab.isc.org | OTHER | Out of Scope | 21:40 |
| Removed | lists.isc.org | OTHER | Out of Scope | 21:40 |
| Removed | any asset that is not explicitly included in our program's scope | OTHER | Out of Scope | 21:40 |
| Removed | any third parties’ or community’s assets (e.g. packages or versions not created and published by isc) | OTHER | Out of Scope | 21:40 |
| Removed | any depreciated versions and other versions than the current stable/official version are considered out of scope | OTHER | Out of Scope | 21:40 |
| Removed | any local implementation of the project/implementation belonging to third parties | OTHER | Out of Scope | 21:40 |
| Removed | vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Out of Scope | 21:40 |
| Added | gitlab.isc.org | OTHER | Out of Scope | 00:33 |
| Added | lists.isc.org | OTHER | Out of Scope | 00:33 |
| Added | any asset that is not explicitly included in our program's scope | OTHER | Out of Scope | 00:33 |
| Added | any third parties’ or community’s assets (e.g. packages or versions not created and published by isc) | OTHER | Out of Scope | 00:33 |
| Added | any depreciated versions and other versions than the current stable/official version are considered out of scope | OTHER | Out of Scope | 00:33 |
| Added | any local implementation of the project/implementation belonging to third parties | OTHER | Out of Scope | 00:33 |
| Added | vulnerabilities in the dns protocol that are not specific to the bind 9 implementation (while we are interested in these, they are out of scope of this bug bounty program) | OTHER | Out of Scope | 00:33 |