Now in Beta

Harbor Project

Responsible vulnerability disclosure for nonprofit organizations.

Harbor connects ethical researchers with nonprofits to report vulnerabilities responsibly, collaborate securely, and resolve risk faster.

JOIN THE WAITLIST

From vulnerability to resolution

Sample data Live workspace

Reports Received

Confirmed Findings

Open Reports

Avg. Response Time

Severity Distribution

Critical 12
High 34
Medium 61
Low 41

Report Status Overview

SubmittedSubmitted9
Under ReviewUnder Review14
TriagedTriaged11
ConfirmedConfirmed8
In Remed.In Remediation6
ResolvedResolved74
ClosedClosed26

Reports Queue

8 open

HRB-2287

IDOR exposes patient records via sequential chart IDs

@s1ackwater · records.example.org · 2h ago

CriticalTriaged

HRB-2284

Stored XSS in appointment notes field

@r1pt1de · portal.example.org · 5h ago

HighUnder Review

HRB-2281

SSRF in avatar image fetcher reaches metadata endpoint

@l33ward · api.example.org · 9h ago

HighConfirmed

HRB-2279

Session fixation on the SSO callback

@f0ghorn · auth.example.org · 22h ago

MediumIn Remediation

HRB-2276

Rate limit missing on password-reset request

@keelhaul · auth.example.org · 1d ago

MediumSubmitted

HRB-2270

Verbose stack trace leaks framework version

@flotsam · api.example.org · 2d ago

LowResolved

HRB-2264

CSRF on notification-preferences update

@s1ackwater · portal.example.org · 3d ago

MediumResolved

HRB-2258

Reflected XSS in search query parameter

@r1pt1de · portal.example.org · 4d ago

HighClosed

HRB-2287

IDOR exposes patient records via sequential chart IDs

@s1ackwater · records.example.org · 2h ago

CriticalTriaged

HRB-2284

Stored XSS in appointment notes field

@r1pt1de · portal.example.org · 5h ago

HighUnder Review

HRB-2281

SSRF in avatar image fetcher reaches metadata endpoint

@l33ward · api.example.org · 9h ago

HighConfirmed

HRB-2279

Session fixation on the SSO callback

@f0ghorn · auth.example.org · 22h ago

MediumIn Remediation

HRB-2276

Rate limit missing on password-reset request

@keelhaul · auth.example.org · 1d ago

MediumSubmitted

HRB-2270

Verbose stack trace leaks framework version

@flotsam · api.example.org · 2d ago

LowResolved

HRB-2264

CSRF on notification-preferences update

@s1ackwater · portal.example.org · 3d ago

MediumResolved

HRB-2258

Reflected XSS in search query parameter

@r1pt1de · portal.example.org · 4d ago

HighClosed

Reports Submitted

Accepted

Total Earnings

Reputation

Programs

Behavioral health providerBug Bounty
4 assets in scope · $250–$5,000
Community health centerBug Bounty
3 assets in scope · $300–$6,000
Legal aid organizationVDP
2 assets in scope · No bounty
Food security nonprofitVDP
2 assets in scope · No bounty
Education nonprofitBug Bounty
3 assets in scope · $200–$4,000

My Reports

IDOR exposes patient records via sequential chart IDs
Behavioral health provider · 2h ago
CriticalTriaged
CSRF on notification-preferences update
Behavioral health provider · 3d ago
MediumResolved
Broken access control on exported case PDFs
Legal aid organization · 5d ago
HighIn Remediation
Volunteer roster enumeration via predictable IDs
Food security nonprofit · 1w ago
LowResolved

Protecting data that can't be reissued

The records at stake

Category	Example record	Sensitivity
Patient recordsHRB-2287 · IDOR exposing records	chart #4471	Critical
Immigration status	case A-22	Critical
Shelter addresses	intake form	Critical
Minors' records	scholar file	Critical
Donor financials	gift ledger	High
Case files	matter #318	High
Benefits eligibility	SNAP record	Medium

A clear disclosure process from report to resolution

Submission

Patient portal

Report title

IDOR exposes patient records via sequential chart IDs

Severity estimate

CriticalHighMediumLowInformational

Affected asset

records.example.org

2 attachments

Triage

HRB-2287Critical

IDOR exposes patient records via sequential chart IDs

TriagedSubmittedTriagedlifecycle advancing

R. Almeida (Researcher)

Incrementing the chart_id in /records/:id returns another patient's file with no authorization check.

M. Okafor (Organization member)

Reproduced. Escalating to engineering and confirming as Critical.▍

Resolution

HRB-2287Critical

Resolved

Remediation verified

Optional reward issued · $5,000

A researcher files a structured report against an in-scope asset.

Your team reviews reproducible steps, works with security professionals, and moves forward toward remediation.

The issue is resolved and disclosed.

Built for the organizations that get left out

Researcher

Search programs or organizations…

Behavioral health providerBug Bounty

Mental-health records for the patients in its care.

4 assets in scope$250–$5,000

Community health centerBug Bounty

Clinics serving low-income patients in the community.

3 assets in scope$300–$6,000

Legal aid organizationVDP

Free civil legal representation for people who can't afford it.

2 assets in scope

Food security nonprofitVDP

Coordinating food distribution for families facing hunger.

2 assets in scope

Education nonprofitBug Bounty

Scholarships and records for first-generation students.

3 assets in scope$200–$4,000

Behavioral health providerBug Bounty

Mental-health records for the patients in its care.

4 assets in scope$250–$5,000

Community health centerBug Bounty

Clinics serving low-income patients in the community.

3 assets in scope$300–$6,000

Legal aid organizationVDP

Free civil legal representation for people who can't afford it.

2 assets in scope

Food security nonprofitVDP

Coordinating food distribution for families facing hunger.

2 assets in scope

Education nonprofitBug Bounty

Scholarships and records for first-generation students.

3 assets in scope$200–$4,000

Safe harbor and scope

Scope

Assets explicitly approved for security testing.

portal.example.orgIn scope
api.example.orgIn scope
auth.example.orgIn scope
records.example.orgIn scope

Accepted vulnerability types

Server-side Remote Code Execution (RCE)SQL Injection (SQLi)Server-Side Request Forgery (SSRF)Cross-site Scripting (XSS)XML External Entity Attacks (XXE)Local File Disclosure (LFD)Cross-site Request Forgery (CSRF)Access Control Issues (ACI)

Excluded vulnerability types

Network level Denial of ServiceApplication level Denial of ServiceClickjacking or issues only exploitable through clickjackingXSS issues that only affect outdated browsersPassword brute-forcingPassword complexity guidelinesLack of security-related flags on cookiesLack of email validationEmail or user enumerationReflected File Download (RFD)Self-XSS (unchained)Issues that require physical access to a victim's computerIssues that require privileged access to the victim's network

Safe Harbor

The protections researchers get for good-faith testing.

Good-Faith Protection

Participating organizations agree not to pursue legal action for good-faith research that complies with published scope, methods, and responsible disclosure requirements.

Conditions for Protection

Stay in scope: Testing must be limited to explicitly authorized assets and permitted methods. Minimize harm: Researchers should avoid data destruction, service disruption, social engineering, and access beyond what is needed for verification.

Exclusions

Safe harbor does not apply to out-of-scope testing, malicious intent, extortion, privacy abuse, or any activity prohibited by applicable law.

Coordinated Communication

Use Harbor channels for all report communication and status updates so both parties can maintain a complete and auditable disclosure timeline.

Policy Changes

Programs may update scope and policy terms over time. Researchers are responsible for reviewing the latest terms before testing.

Harbor

Responsible security. Built for the mission.

Join the organizations and researchers protecting the work that matters.

JOIN THE WAITLIST