Patchstack
Estonian vulnerability intelligence company with a WordPress bug bounty, managed VDP and mitigation rules
Quick Overview
| Company | Patchstack OÜ |
|---|---|
| Category | Web Application Firewall |
| Headquarters | Pärnu, Estonia |
| Founded | Not stated |
| EU Presence | Yes - Estonia (EU) |
| Data Location | Not stated on the pages checked |
| Open Source | No |
| GDPR Compliant | Yes |
| Self-Hosting | No |
| Main Features | WordPress bug bounty with monthly pool, managed VDP, vulnerability database, RapidMitigate rules, threat intelligence API, application security (SCA), CRA compliance |
| Pricing | See website; separate pricing page for mitigation |
| Best For | WordPress plugin and theme vendors that need a managed disclosure channel |
| Replaces | HackerOne VDP, Bugcrowd VDP (for the WordPress ecosystem) |
Detailed Review
Patchstack's terms of service are entered into with Patchstack OÜ, commercial register code 14331217, Aida tn 7, Pärnu, Estonia. Governing law is Estonian for customers outside the Americas, and Delaware law for customers headquartered in North, Central or South America.
This is a niche entry: the bounty and the managed VDP apply to the WordPress and open-source software ecosystem, not to a general company web estate.
Bounty for WordPress Researchers
The bounty page lists a guaranteed monthly pool of USD 10,000 shared by contribution, plus zero-day payouts up to USD 33,000 for high-impact findings in components with very large install bases. Payouts go by PayPal or by Bitcoin or Ethereum.
Researchers report through Patchstack, which assigns the CVE in their name and handles contact with the vendor.
Managed VDP for Maintainers
The managed VDP product lets plugin and software maintainers hand incoming reports to Patchstack. The site lists an active VDP directory and says Patchstack manages security for 1,134 plugins.
Maintainers also get access to a vulnerability database and mitigation rules aimed at hosting providers.
Not a General Bounty Platform
There is no open-ended program where a company scopes its own web application. Companies outside the WordPress and open-source world should look at the other tools in this list.
Limitations to Consider
Scope is the WordPress and open-source ecosystem, so a general company cannot host a custom bounty here. Rewards are quoted in US dollars and paid via PayPal or cryptocurrency. The terms apply Delaware law for customers in the Americas. The pages checked give no hosting location. For a general-purpose program see Intigriti.
Who Should Use Patchstack
WordPress plugin, theme and hosting businesses that want a managed disclosure channel and CVE handling.
Pros and Cons
Pros
- Estonian OÜ with register code published
- Managed VDP takes over report handling
- CVEs assigned in the researcher's name
- Public vulnerability database
- Mitigation rules for hosts
Cons
- WordPress and open-source scope only
- Rewards in USD, paid by PayPal or crypto
- No hosting location stated
- Delaware law applies to customers in the Americas
Alternatives to Patchstack
Other European web application firewall worth comparing before you decide:
Myra Security
Germany · German security platform with a WAF, DDoS filter and CDN
Airlock
Switzerland · Swiss WAF and API gateway from Ergon Informatik
Link11
Germany · German cloud WAF with AI-based DDoS filtering
Gcore
Luxembourg · Luxembourg edge platform with WAF and DDoS protection
See all European web application firewall or compare them directly against HackerOne VDP on our alternatives page.
Frequently Asked Questions
Not a general one. The bounty is for WordPress vulnerabilities, and the managed VDP is for plugin and software maintainers.
Patchstack OÜ, an Estonian company with commercial register code 14331217, based in Pärnu.
By PayPal or by cryptocurrency (Bitcoin or Ethereum), according to the bounty FAQ.