Mailcow bug bounty programs

Mailcow programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
MA Mailcow Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	–	Open

• MA

  Mailcow

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://mailcow.email

  Web

• Aliases, forwarding hosts, relay settings and everything else deciding where mail leaves this server for

  Products and areas

• Autodiscover and autoconfig, the endpoints a mail client hits before it has been configured and which answer without authentication

  Products and areas

• Logging and log display: the login history, the autodiscover log and every other view rendering data a remote party supplied

  Products and areas

• The authorization model across the three panel levels, covering what a domain admin or a mailbox user can reach of another tenant's configuration

  Products and areas

• The container orchestration mailcow ships: the compose definitions, the entrypoint scripts, the update mechanism and the secrets passed between containers

  Products and areas

• The mailcow API, including API-key authentication and every endpoint that creates, modifies or deletes a mail object

  Products and areas

• The mailcow UI in full: the administrator panel, the domain-admin panel and the mailbox-user panel, three different privilege levels on the same application

  Products and areas

• The policy asks for security vulnerabilities by email to the mailcow team and describes a coordinated fix process. It draws no boundary narrower than the stack mailcow ships, so everything mailcow itself writes or wires together is inside it

  Products and areas

• The quarantine interface, where an administrator reads attacker-supplied subject lines, sender addresses and attachment filenames inside a privileged browser session

  Products and areas

• Two-factor handling, app passwords and the session machinery behind the panels

  Products and areas

No target matches. Try part of a host name, such as the company name.