Security Bug Bounty Program Paused Due to Loss of Funding

The Node.js project's security bug bounty program is being paused due to the discontinuation of its external funding source.

Since 2016, the Node.js project has participated in the Internet Bug Bounty (IBB) program through HackerOne, offering monetary rewards to security researchers who responsibly disclosed vulnerabilities in Node.js. The program was a meaningful part of our security ecosystem, and we're grateful to the researchers who participated.

The Internet Bug Bounty (IBB) program, which supported bounty rewards for Node.js through a pooled donation-funded initiative, has been paused. You can read more about the pause here . This decision was not made by the Node.js project.

As a volunteer-driven open-source project, Node.js does not have an independent budget to sustain a bounty program…