- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 17
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Ada Health does not guarantee any compensation for reporting security vulnerabilities through its vulnerability disclosure program.
- Response
-
Within 2 days
You will receive a verification reply email from us (usually within 2 business days of your report being sent).
- Safe harbor
-
Partial
This policy does not permit security researchers to act in any manner that is inconsistent with legal or regulatory compliance requirements within the countries in which Ada operates or within the country where the security researcher is located.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
17 assets you may test, 8 excluded.
Domains 5
- ada.com
- ada.health
- adahealth.ca
- adahealth.net
- ada.me
Wildcard domains 5
- *.ada.com
- *.ada.health
- *.adahealth.ca
- *.adahealth.net
- *.ada.me
Android apps 3
- Android No bounty
- https://play.google.com/store/apps/details?id=com.ada.app No bounty
- iOS No bounty
iOS apps 1
- https://apps.apple.com/app/id1099986434?l=en No bounty
Products and areas 3
- ) applications No bounty
- Mobile No bounty
- Mobile ( iOS and Android ) applications
Out of scope (8)
- API Token / OAuth secret recoverable in application binaries
- DNSSEC, DNS CAA configuration
- Email-related security configurations (e.g., SPF, DKIM, DMARC)
- Missing security headers (e.g., Content-Security-Policy, X-Frame-Options, Feature-Policy, HTTP Strict Transport Security, HTTP Public Key Pinning, X-XSS-Protection, Referrer-Policy)
- Reports of non-exploitable vulnerabilities
- Security issues in third-party applications which Ada does not manage
- TLS configuration weaknesses (e.g., TLS1.0 usage, sweet32, lucky SSL vulnerabilities, "weak" cipher suite support)
- Volumetric vulnerabilities (Restrict usage of automated tools to no more than ten requests/second)
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Ada Health's policy. "We" in these lines means the program, not this site.
While testing
-
We ask that security researchers provide a non-destructive, non-damaging proof of exploitation.
-
We also ask that security researchers do not publicly release the details of such issues until Ada has had sufficient time to review and mitigate the reported issues.
-
You must not break any applicable laws or regulations, including, without limitation, data protection laws and regulations such as the GDPR.
-
Moreover, you must securely delete all data retrieved during your research as soon as it is no longer required.
-
Restrict usage of automated tools to no more than ten requests/second
-
All reports should be sent to the address on the policy page and not copied to other email addresses.
-
Please ensure a minimum timeframe of 20 business days from the time of disclosure.
Not accepted
-
Security issues in third-party applications which Ada does not manage
-
Reports of non-exploitable vulnerabilities
-
Volumetric vulnerabilities
-
TLS configuration weaknesses
-
Missing security headers
-
Email-related security configurations (e.g., SPF, DKIM, DMARC)
-
DNSSEC, DNS CAA configuration
-
API Token / OAuth secret recoverable in application binaries
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.