Aptible

Bug bounty on Self-hosted aptible.com

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash: Yes Aptible offers cash rewards and prizes to security researchers who report exploitable vulnerabilities.
Response: Within 7 days If you share contact information and your submission complies with all requirements in this policy, we will acknowledge receipt of your report within 7 business days.
Safe harbor: Full If you make a good-faith effort to comply with this policy during your security research, we will consider your research to be authorized, will work with you to understand and resolve the issue quickly, and will not recommend or pursue legal action related to your research.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

8 assets you may test, 2 excluded.

Out of scope (2)

What the policy asks of you, and the bug types it won't reward, quoted from Aptible's policy. "We" in these lines means the program, not this site.

Notify us as soon as possible after you discover an actual or potential security issue.
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
Only use exploits to the extent necessary to confirm a vulnerability’s presence.
Provide us with a reasonable amount of time to resolve the issue before you disclose it publicly.
Do not submit a high volume of low-quality reports.
Do not attempt to degrade service.
Test only on in-scope domains listed below.
We request that any scripts or exploit code be embedded into nonexecutable file types.
We can process all common file types but do not accept any Zip file archives.

CSRF on forms that are available to anonymous users
Logout Cross-Site Request Forgery (logout CSRF)
Email and domain security configuration suggestions, including but not limited to misconfigurations in SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and DNSSEC
Disclosure of known public files or directories (e.g. robots.txt)
Functional, UI, and UX bugs and spelling mistakes
Banner disclosure on common/public services
HTTP/HTTPS/SSL/TLS security header configuration suggestions
Lack of Secure/HTTPOnly flags on non-sensitive cookies
HTTP 404 codes/pages or other HTTP error codes/pages
Rate limiting or brute-force issues
Self-XSS (self cross-site scripting)
Phishing or Social Engineering Techniques
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality
Clickjacking attacks
Content Security Policy (CSP) configuration

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 6 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake