APNIC

Vulnerability disclosure program on Self-hosted apnic.net

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No As a not-for-profit, it is difficult for us to pay out financial bounties, but we really appreciate your help in safeguarding our systems.
Response: Within 7 days We aim to reply to all reports within 7 days, and to resolve reported vulnerabilities that are a medium severity and higher within 90 days.
Safe harbor: Full we will not initiate or support legal action against you for accidental, good faith violations of this program
Hall of fame: Yes If we confirm your finding as a new vulnerability, we can recognize your contribution in the section below.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

12 assets you may test, 11 excluded.

Out of scope (11)

What the policy asks of you, and the bug types it won't reward, quoted from APNIC's policy. "We" in these lines means the program, not this site.

Use the Test Only event, do not use any public events/conferences
Use the testing mailing list, do not use any public mailing lists
We appreciate your cooperation in avoiding privacy violations, damaging data, or causing interruption to any of our services while you perform your research.
Testing on real conferences/events on submission.apnic.net – please use the Test Only event
Testing on real/public mailing lists – please use the testing list

FTP, HTTP, or rsync directory listing on the following: (working as intended)
Information disclosure and reflected XSS vulnerabilities for *.rand.apnic.net and *.labs.apnic.net
DMARC policy set to “none” (working as intended)
Rate limiting or brute force issues on non-authenticated endpoints
Missing HttpOnly or Secure flags on cookies that don’t relate to user authentication/credentials
Destruction of data
DoS/DDoS
Social engineering
Physical security controls

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake