The Node.js project has paused its long-running bug bounty program after the funding behind it was discontinued, removing a key security incentive from one of the most widely used JavaScript runtimes.

For nearly a decade, Node.js participated in the Internet Bug Bounty (IBB) program through HackerOne, offering monetary rewards to researchers who responsibly disclosed security issues. That program is now on hold, leaving Node.js without a funded bounty structure for the first time since 2016.

The decision was not made by the Node.js project itself. Instead, it follows the pause of the broader IBB initiative, a pooled, donation-backed effort that supported multiple open source projects. Without that external funding, Node.js does not have the resources to continue offering payouts.

The Internet Bug Bounty program itself is now on hold. As of March 27, it is no longer accepting new submissions but existing reports will still be processed and paid out.

The program's organizers report that the pause was driven in part by changes in the vulnerability discovery landscape, including a surge in AI-assisted research that has increased the volume of findings without a corresponding increase in remediation capacity:

The discovery landscape is changing. AI-assisted research is expanding vulnerability discovery across the ecosystem, increasing both coverage and speed. The balance between findings and remediation capacity in open source has substantively shifted. We have a responsibility to the community to ensure this program effectively accomplishes its ambitious dual purpose: discovery and remediation. Accordingly, we are pausing submissions while we consider the structure and incentives needed to further these goals.

Security reporting itself is unchanged. Researchers can still submit vulnerabilities through HackerOne, and the Node.js security team will continue triaging and releasing fixes as before. The only difference is that reports will no longer be eligible for financial rewards.

A Longstanding Model for Open Source Security

Node.js’ reliance on the Internet Bug Bounty is not unusual in open source security: many critical projects depend on external funding rather than dedicated budgets.

The IBB program, originally backed by companies like Microsoft and Facebook, was designed to support foundational internet infrastructure projects that lacked the resources to run their own bounty programs. It helped extend the bug bounty model, popularized in the 2010s by platforms like HackerOne, into the open source ecosystem.

That model has always had tradeoffs. Bug bounty programs can significantly increase the number of vulnerabilities reported, but a large portion of submissions are often invalid or low quality, requiring substantial triage effort. For volunteer-led projects like Node.js, that overhead has been a recurring challenge.

Recent Strain on the Bug Bounty Program

Even before the funding pause, Node.js had been adjusting how its bounty program operated.

Earlier this year, the project introduced stricter submission requirements on HackerOne, including a minimum reputation threshold, after an influx of low-quality reports. The change was aimed at reducing noise and helping maintainers focus on actionable vulnerabilities.

Today's announcement comes as the project is already dealing with pressure on its vulnerability reporting pipeline, due to scaling challenges around vulnerability intake, even when financial incentives were in place.

Incentivized Reporting Moves to Voluntary Disclosure#

The bug bounty program pause shifts Node.js closer to a traditional responsible disclosure model.

Bug bounty programs are often seen as a way to align incentives by rewarding researchers financially. But research has shown that money is only one motivator. Recognition, reputation, and the opportunity to contribute to widely used software also play a significant role.

Node.js is now relying more heavily on those non-monetary incentives, at least for the time being. The project isn’t alone. The cURL project recently dropped its bug bounty program entirely, after being overwhelmed by a flood of low-quality, often AI-generated reports that made the program unsustainable.

cURL maintainer Daniel Stenberg communicated the change as a potential improvement rather than a setback:

We believe that we can maintain and continue to evolve curl security in spite of this change. Maybe even improve thanks to this, as hopefully this step helps prevent more people pouring sand into the machine. Ideally we reduce the amount of wasted time and effort. I believe the best and our most valued security reporters still will tell us when they find security vulnerabilities.

While Node.js is pausing its program for different reasons, the outcome may not be entirely negative. Without financial incentives, projects sometimes see fewer low-quality submissions and a higher signal-to-noise ratio, relying more on researchers who report issues without expecting payouts.

The Reality of Unfunded Critical Infrastructure#

The Node.js project has indicated that it may revisit the program if dedicated funding becomes available. That exposes a gap in how critical open source infrastructure is funded, especially for security work that benefits the entire ecosystem.

Most critical open source projects don’t have independent security budgets, so it's not unusual that even something as central as Node depends on pooled funding models like the Internet Bug Bounty.

The Node.js ecosystem is currently getting hammered by supply chain attacks, alongside increased scrutiny on runtimes and more automated vulnerability discovery. Removing financial incentives right now may reduce signal from independent researchers, especially the ones who treat bug bounties as income. It shifts Node back toward goodwill-driven disclosure, which is historically less consistent at scale.

That said, it’s also a reflection of reality. Node never really owned the program financially, and sustaining security incentives for critical infrastructure depends on whether open source consumers are willing to fund it.