- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Rewards are issued in one or more of the following forms: Amazon gift cards Atlan swag and merchandise Public recognition on our Hall of Fame
- Response
-
Within 7 days
Triage and validation: Within 7 business days
- Safe harbor
-
Partial
To qualify for safe harbor protection and be eligible for recognition, you must:
- Hall of fame
-
Yes
With your permission, we’ll add your name and social profile to our Hall of Fame once the vulnerability is fixed.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test, 7 excluded.
Wildcard domains 2
- *.atlan.com
- *.atlan.com (excluding explicitly out-of-scope domains listed below)
APIs 1
- API endpoints and authentication systems
Domains 1
- atlan.com
Products and areas 1
- Atlan’s main application and associated services that process customer data
Out of scope (7)
- Open Source Repositories
- https://atlan.com (marketing website)
- https://blog.atlan.com
- https://docs.atlan.com
- https://humansofdata.atlan.com
- https://metadatabank.atlan.com
- https://university.atlan.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Atlan's policy. "We" in these lines means the program, not this site.
While testing
-
Make every effort to avoid privacy violations, data destruction, or service degradation
-
Use exploits only to the extent necessary to confirm a vulnerability’s existence
-
Immediately cease testing and report if you encounter customer data, PII, or sensitive information
-
Perform testing only on in-scope systems
-
Do not access, modify, or delete data belonging to others without explicit permission
-
Limit automated scanning to prevent service degradation
-
Do not leverage access to one customer’s data to access another customer’s data
-
Do not share, discuss, or publish vulnerability details until we provide explicit authorization
-
Use only our designated submission platform for all vulnerability-related communications
-
Do not use social media, public forums, or other channels for disclosure
Not accepted
-
Physical security issues (e.g., office access, tailgating)
-
Social engineering attacks (e.g., phishing, vishing)
-
Findings from automated scanners without demonstrated exploitability
-
Generic “best practice” recommendations without security impact
-
Functional bugs, UI/UX issues, or spelling mistakes
-
Username enumeration via login or password reset error messages
-
Missing account lockout or rate limiting on authentication endpoints
-
Lack of CAPTCHA or weak CAPTCHA implementation
-
Logout CSRF
-
Missing HTTP security headers (e.g., X-Frame-Options, X-Content-Type-Options)
-
Missing or incomplete security.txt file
-
Missing email authentication records (SPF, DKIM, DMARC)
-
Presence of autocomplete or password save functionality
-
OPTIONS/TRACE HTTP methods enabled
-
SSL/TLS attacks (BEAST, BREACH, renegotiation)
-
Missing forward secrecy
-
Weak cipher suites (unless supporting only outdated versions)
-
Content Security Policy (CSP) best practices without bypass
-
Open redirect without additional security impact
-
Clickjacking on pages without sensitive actions
-
CSRF on unauthenticated or low-impact actions
-
Descriptive error messages (e.g., stack traces on public pages)
-
HTTP 404 or non-200 status codes
-
Banner or version disclosure on common services
-
Internal IP address disclosure
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− Cloud Services
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.