- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 22
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Currently, we only offer non-monetary rewards for each confirmed vulnerability report.
- Response
-
Within 7 days
Upon discovering a security issue and communicating it with [email protected] , a researcher can expect a response within seven days.
- Safe harbor
-
Partial
When the security issue has been satisfactorily resolved, the researcher is welcome to publicly disclose the finding
- Hall of fame
-
Yes
Additionally, all eligible researchers will be honored with a well-deserved place in our prestigious Hall of Fame, where your name will be displayed among the talented individuals who have made significant contributions to improving our security posture.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
22 assets you may test.
Domains 22
- accengage.net
- airship.com
- airship.eu
- analyze.airship.com
- analyze-api.airship.com
- apptimize.com
- apptimize.eu
- combine.urbanairship.com
- device-api.urbanairship.com
- docs.airship.com
- go.airship.com
- gummicube.com
- sftp.airship.com
- support.airship.com
- support-eu.airship.com
- team.airship.com
- urbanairship.com
- www.airship.com
- www.airship.eu
- www.apptimize.com
- www.apptimize.eu
- www.gummicube.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Airship's policy. "We" in these lines means the program, not this site.
While testing
-
Share the issue with Airship prior to sharing it publicly or with any other party via email, the only authorized method of communication in which any research or potential findings should be discussed.
-
Allow us reasonable time to respond (seven days to acknowledge and seven day update intervals) to the issue before disclosing it publicly or sharing with any other party
-
Please only test services to which you have authorized access.
-
The researcher must not cut and paste a tool output into a submission without including additional analysis demonstrating the exploitability of a vulnerability.
-
Please provide detailed reports with reproducible steps.
Not accepted
-
Reporting 3rd party components or libraries Airship is currently using are out of date or vulnerable
-
Any suggestions involving the current configurations around these systems and protocols will NOT be acknowledged.
-
Any suggestions involving the current configurations around these protocols will NOT be acknowledged.
-
No bounty or acknowledgement will be issued for disclosing a bug or vulnerability publicly without informing Airship in accordance with this policy
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− airship.eu, − urbanairship.com, − apptimize.com and 2 more
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.