- Top reward
- $500
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $500
- top reward, from $50.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Paid by PayPal
- No identity requirement stated.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The old policy link stopped working, so we followed the company's security.txt to the current policy.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$500
Our typical reward is between $50 and $500 USD.
- Lowest reward
-
$50
Our typical reward is between $50 and $500 USD.
- Safe harbor
-
Partial
Continuing to access another person's data or company data may demonstrate a lack of good faith and disqualify you from any benefit of the Safe Harbour Provisions described below.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 1 excluded.
Domains 1
- accredible.com
Out of scope (1)
- third-party applications or websites not owned or controlled by Accredible
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Accredible's policy. "We" in these lines means the program, not this site.
While testing
-
You give us reasonable time to investigate and mitigate an issue that you report before making any information about the report public or sharing such information with others.
-
You do not exploit a security issue that you discover for any reason.
-
You do not interact with an individual account (which includes modifying or accessing data from the account) without the account owner's explicit consent in writing, which you must produce upon request.
-
You make a good faith effort to avoid privacy violations and disruptions to others, including (but not limited to) unauthorised access to or destruction of data, and interruption or degradation of our services.
-
When submitting a vulnerability, please provide concise steps to reproduce that are easily understood.
-
If the same vulnerability is found on multiple hosts associated with the same asset/domain, please include all vulnerable hosts in a single report.
-
please do not contact our staff directly but use the above email contact method instead.
Not accepted
-
Wordpress Configuration or features ( www.accredible.com )
-
Content spoofing / text injection
-
Self-XSS [to be valid, cross-site scripting issues must be exploitable via reflected, stored or DOM-based attacks]
-
Logout and other instances of low-severity Cross-Site Request Forgery
-
Cross-site tracing (XST)
-
Open redirects with low security impact (exceptions are those cases where the impact is higher such as stealing OAuth tokens)
-
Missing HTTP security headers
-
Missing cookie flags on non-sensitive cookies
-
Password and account recovery policies, such as reset link expiration or password complexity
-
Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM)
-
Vulnerabilities only affecting users of outdated or unpatched browsers and platforms
-
SSL/TLS best practices
-
Clickjacking/UI redressing with no practical security impact
-
Software version disclosure
-
Username / email enumeration via Login Page or Forgot Password Page error messages
-
Methods to extend product trial periods.
-
EXIF Geolocation Data
-
DMARC Configuration
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-50827 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Accredible Accredible Certificates & Open Badges allows Stored XSS.This issue affects Accredible Certificates & Open Badges: from n/a through 1.4.8. | Medium 5.9 | 21 Dec 2023 |