Discord

Social Media

Communication platform for communities with voice, video, and text chat, serving 200M+ monthly active users globally.

Max Reward

$20,000

Total Paid

$3,600,000

Resolved

456

Avg Response

2 days

discord.com

Web client, authentication, and settings

Discord API

Bot API, OAuth2, and gateway WebSocket

Discord Desktop

Electron-based desktop application

Discord Mobile

iOS and Android applications

Critical

RCE, authentication bypass, privilege escalation, fund extraction

High

Stored XSS, CSRF with impact, API abuse, data manipulation

Medium

Reflected XSS, data leakage, logic flaws, information disclosure

Low

Verbose errors, minor config issues, low-impact info disclosure

ID	Title	Severity	Status	Reward	Submissions
DSC-001	Remote code execution via crafted embed in desktop client	Critical	Open	$10,000–$20,000	0
DSC-002	OAuth2 token theft via open redirect in authorization flow	High	In Review	$3,000–$8,000	1

• Do not access, modify, or delete data belonging to other users.

• Do not perform denial-of-service attacks or automated scanning at high volume.

• Report vulnerabilities promptly and provide sufficient detail to reproduce.

• Allow reasonable time for fix before public disclosure (90 days).

• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.