Public bug bountyLaunched Apr 2026 · Updated 2 months ago

Fable Media

Publishing platform & subscriber accounts · fable.media

  • Accepting reports
  • Public
  • Self-serve triage
  • Safe harbour
Your access
Open to every researcher

Sign in with a researcher account to file a report.

Submit a report Read the rules of engagement first
Max bounty
$4,500
Avg. response
2.9 days
Reports resolved
71
Bounties paid
$96k
Researchers
34

Overview

Fable Media publishes long-form journalism behind a subscriber paywall. The reading experience, the subscriber account area and the editorial CMS are all in scope.

Program terms

Type
Public
Rewards
Bounty · USD
Triage
Self-serve
Disclosure
Coordinated
Safe harbour
Offered
Status
Active

Response targets

First response
3 days
Triage decision
6 days
Resolution
45 days
Avg. first response
2.9 days

Scope

3 in · 4 out

In scope

In-scope assets
AssetTypeEnvironment
www.fable.mediaWebProduction
accounts.fable.mediaWebProduction
Editorial CMSWebProduction

Out of scope

Out-of-scope assets and activities
Asset or activityReason
Newsletter delivery vendor—
Archived static microsites—
Denial-of-service / volumetric—
Paywall bypass by disabling JavaScript—

Not rewarded

  • Denial of service / volumetric attacks
  • Self-XSS requiring victim-side paste
  • Missing security headers without demonstrated impact
  • Rate-limit or user enumeration without demonstrated impact
  • SPF / DKIM / DMARC configuration
  • Social engineering of staff or users
  • Best-practice reports with no security consequence

Rewards

USD · per valid finding
Rewards by severity
SeverityBounty
CriticalRCE, auth bypass, mass data exposure$4,500from $1,800
HighSSRF, stored XSS, privilege escalation$1,700from $680
MediumIDOR, CSRF on sensitive actions$420from $170
LowReflected XSS, minor info disclosure$90from $40
Final severity is set by Fable Media.Ranges are per valid, in-scope finding.

Rules of engagement

5 rules

  1. Test only assets listed in scope. Never access, modify or delete data that does not belong to your test account.

  2. Use your own test accounts. Stop immediately if you encounter another user's data and report it.

  3. No denial-of-service, automated scanning at scale, or social engineering of staff or users.

  4. Report each vulnerability once, with clear reproduction steps and evidence. Duplicates are closed against the earliest valid report.

  5. Keep findings confidential until Fable confirms a fix and agrees to disclosure. Good-faith research is authorized and will not be pursued legally.

Testing requirements

Use the test accounts issued to you. Tag automated traffic with a `X-Bug-Bounty: <your-handle>` header and keep request rates below 5/s.

Authorization

Testing is authorized only within the scope and rules on this page. Findings outside scope are not eligible and may not be protected under safe harbour.

Disclosure & safe harbour

Disclosure policy

Coordinated

Fable Media agrees a publication date with you once the issue is resolved.

Safe harbour

Offered

Fable Media will not pursue legal action against good-faith research within these rules.

Safe harbour statement
Fable will not pursue civil or criminal action, or send notice to law enforcement, for accidental or good-faith violations of this policy. We consider research conducted under it to be authorized, lawful and helpful to the overall security of the internet. You remain responsible for complying with any other applicable laws.

Recent activity

Latest 3
  • LowVerbose error leaks stack traceResolved · $150
  • HighDraft articles readable before publicationResolved · $1,690
  • MediumSubscriber email enumeration on loginAccepted
Ready to report

Found something on Fable Media?

Submit a structured report with steps and evidence. Self-serve triage reviews it, and a valid finding is rewarded by severity.

Submit a report All programs