Work at Auth0 by Okta? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.
Ask BugRater to submit itPrivate. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Reviews
0 publishedNo reviews yet.
Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 3 Oct 2026.
We recognize the crucial role of community researcher involvement and the establishment of a robust foundation in safeguarding our customers and their data. We value every security submission and aim to provide prompt responses. Auth0 welcomes you to participate in testing and enhancing the security of our Identity Platform. Your dedication and contributions to strengthening our security are greatly appreciated, and we eagerly anticipate collaborating with the researcher community to develop a rewarding and effective bug bounty program. Best of luck and happy hunting!
Scope
37 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| .NET SDK (Auth0.Net) | other | ✓ bounty | not set |
| *.cic-bug-bounty.auth0app.com | website | ✓ bounty | not set |
| Auth0 Guardian Android | android | ✓ bounty | not set |
| Auth0 Guardian IoS | ios | ✓ bounty | not set |
| Auth0 Java SDK (auth0-java) | other | ✓ bounty | not set |
Show all 37 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| Auth0 Next.js SDK (nextjs-auth0) | other | ✓ bounty | not set |
| Auth0 PHP SDK (auth0-php) | other | ✓ bounty | not set |
| Auth0 React Native SDK (react-native-auth0) | other | ✓ bounty | not set |
| Auth0 SDK for Web (Auth0.js) | other | ✓ bounty | not set |
| Auth0 Single Page App SDK (auth0-spa-js) | other | ✓ bounty | not set |
| auth0.com | website | ✓ bounty | not set |
| auth0.net | website | ✓ bounty | not set |
| config.cic-bug-bounty.auth0app.com | website | ✓ bounty | not set |
| https://api.us1.fga.dev/ | api | ✓ bounty | not set |
| https://customers.us1.fga.dev/ | api | ✓ bounty | not set |
| https://dashboard.fga.dev/ | website | ✓ bounty | not set |
| https://play.fga.dev/ | website | ✓ bounty | not set |
| jwt.io | website | ✓ bounty | not set |
| Lock for Web (lock) | other | ✓ bounty | not set |
| manage.cic-bug-bounty.auth0app.com (Management Dashboard) | website | ✓ bounty | not set |
| marketplace.auth0.com (Auth0 Marketplace) | website | ✓ bounty | not set |
| MFA Integrations | other | ✓ bounty | not set |
| openidconnect.net | website | ✓ bounty | not set |
| samltool.io | website | ✓ bounty | not set |
| webauthn.me | website | ✓ bounty | not set |
| accounts.auth0.com | website | out | not set |
| Auth0 Docs (including quickstarts) | website | out | not set |
| Auth0 passport-ws-fed | other | out | not set |
| auth0.auth0.com | website | out | not set |
| community.auth0.com | website | out | not set |
| goextend.io | website | out | not set |
| https://support.auth0.com/tickets/new | website | out | not set |
| manage.auth0.com | website | out | not set |
| phenix.rocks | website | out | not set |
| sharelock.io | website | out | not set |
| support.auth0.com | website | out | not set |
| webtask.io | website | out | not set |