Thank you. Our bug bounty program has closed.

September 10, 2026

To everyone who looked at TextJam and told us what they found: thank you. We mean that.

We ran a paid bug bounty from September 2025 until September 10, 2026 at 2:00 PM PT. In that time researchers found real problems in our software, and we paid for them. Some of those findings were things we would not have caught on our own, and a few were the kind of server-side authorization gap that is genuinely hard to see from inside a codebase you wrote yourself. Our software is better because people took the time. That is the whole point of a bounty program, and on that measure ours worked.

It is now closed. We no longer offer monetary rewards for security reports at any severity.

Why we closed it

Bug bounty submission has become an automated operation, and the volume outgrew what a small team can triage.

Most of what reached our security inbox in the end was generated output sent to many companies at once: the same small set of findings, in confident technical language, from senders who had not reproduced them and often had not read our scope.

A single sender filing a batch of separate reports within a few minutes of each other. One issue arriving from many different people inside a few weeks, each of them rating it critical. Findings for categories our policy explicitly listed as out of scope, which is the clearest possible sign the page was never read. None of that is unusual, and the totals are heavier than any single example suggests.

The cost of that is not really our time, although it is a lot of our time. The cost is that the people doing careful work ended up waiting in a queue behind things that were never real. Some of them waited months. That is the part we are not willing to keep doing, and it is not a problem we could fix by narrowing the scope, because we tried that in April and the volume went up.

We are not the only ones

This is happening across the industry, to projects far larger than us.

The curl project ended its bug bounty on January 31, 2026, after nine years and more than 100,000 US dollars paid out across 87 confirmed vulnerabilities. Daniel Stenberg wrote that the rate of genuinely valid reports had fallen from somewhere north of 15 percent to below 5 percent, and that the never-ending slop submissions take a serious mental toll to manage. The end of the curl bug-bounty

In May 2026 Linus Torvalds described the Linux kernel's security mailing list as “almost entirely unmanageable” under a flood of duplicate AI-generated vulnerability reports, with maintainers spending their time forwarding things to the right people or pointing out that a bug was fixed a week ago. He called it “all entirely pointless churn”. Coverage of the May 2026 kernel mailing list thread

We are a much smaller team than either. The ratio of volume to the people available to read it is worse for us, not better.

If you reported something while the program was open

We are working through those reports, and we are not using this change to get out of paying anyone.

Anything received before September 10, 2026 at 2:00 PM PT is assessed under the policy that was in force when you sent it. If your report turns out to be new, in scope and reproducible, it will be compensated under those terms. If it does not qualify, you will get a real answer explaining why rather than silence. Some of you have been waiting a long time for that, and we are sorry.

Read the archived bug bounty policy, effective April 30, 2026 to September 10, 2026

We still want your bug reports

None of this means stop telling us about problems. Please keep them coming.

We still read every report, we still fix what is real, and we now credit the first person to report an issue in the changelog entry that ships the fix. Alongside that, we continue to invest in ongoing, in-depth security testing with selected researchers and the latest frontier models, on scopes we define.

How to report a bug or a security issue →

Thanks again to everyone who contributed. It mattered.

The TextJam Team