LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦ 
φPhicommφ — the vulnerability research community
phicomm@disclosure:~$

Disclose. Discuss. Get paid.

Phicomm is a community board where researchers share write-ups, coordinate disclosure with vendors, and track open bounty programs. Attach your PoC to a report so triagers can reproduce it fast.

Browse programs
4,812reports triaged
312active researchers
72hmedian triage time
$2.1Mpaid via partners

Triage within 72h

Volunteer triagers review every report and tag it for the right vendor.

Attach your PoC

Upload scripts, captures and archives (2 MB) directly to your report.

Leaderboard & payouts

Verified reports earn reputation and are forwarded to vendor bounty programs.

Latest disclosures

Pinegrove CMS: stored XSS in gallery plugin (fixed in 4.2.1)

nullbyte_nick 2026-10-16

Write-up for the gallery XSS I reported in August. Vendor patched in 4.2.1 and approved publication.

Timeline: report 08-02, ack 08-03, fix 09-10.

Tallis Mail Gateway: pre-auth path traversal (coordinating)

hexa_dec 2026-10-07

Reproduced on 3.1.x. Vendor is working on a patch. Details withheld until the embargo ends; PoC is with the triage team.

Tips for writing a good reproducer

r3dsun 2026-09-23

Keep PoCs minimal, deterministic and safe to run in a VM. Include a README with exact versions and expected output. Triagers love a Dockerfile.

See all disclosures →

Moderation

Triage queueReviewed daily
Vendor onboardingWeekly