Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Atmail

Bug bounty on Self-hosted atmail.com

Accepting reports Full safe harbor KYC to get paid
Go to program Website
Top reward
$5,000
Top severity paid
Critical
Assets in scope
14
Public CVEs
32
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $5,000
for critical bugs.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 7 days
As the policy promises.
Payment
Proof of identity needed to get paid.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $5,000
High $2,000
Medium $500
Top reward
$5,000 Critical $5,000
Response
Within 7 days Acknowledge receipt of your report within 7 days .
Safe harbor
Full Atmail will not initiate or support legal action or a law enforcement investigation against you in response to such research or reporting, including for accidental, good-faith violations of this Policy;

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

14 assets you may test, 5 excluded.

Domains 5

  • atmailcloud.com
  • atmail.com
  • billing.atmail.com
  • junara.com
  • www.atmail.com

Wildcard domains 4

  • *.atmail.cloud
  • *.atmailcloud.com
  • *.atmail.com
  • *.junara.com

Source code 2

  • All Atmail code shipped with its products, source and binaries, as supplied. Latest versions of currently shipped and supported products only.
  • Source code

Web 1

  • www.atmail.com , limited to content served from this website, excluding third-party components presented via this website

Products and areas 2

  • All Atmail hosted services, public and private cloud installations
  • All Atmail-supplied customer service portals, third-party components excluded
Out of scope (5)
  • status.atmail.com
  • success.atmail.com
  • All third-party services associated with Atmail services
  • Any domain that is a CNAME alias for a third-party system, or proxied through a CDN directly to a third-party platform (e.g. billing.atmail.com , success.atmail.com , status.atmail.com )
  • Atmail software that is end-of-life or no longer supported

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Atmail's policy. "We" in these lines means the program, not this site.

While testing

  • Test only against accounts you own or accounts whose holder has given you documented permission to test against.
  • Never use a finding to compromise or exfiltrate data, escalate beyond the minimum needed for proof, or pivot to other systems.
  • Stop at first proof. Once you have evidence sufficient to demonstrate the vulnerability, stop.
  • Vulnerabilities affecting live Atmail assets must be reported within 72 hours of discovery.
  • Include a custom HTTP header in all testing traffic and state in your report which value you used:
  • Rate limit: automated tooling must not exceed 5 requests per second per host.
  • All supporting evidence must be contained within the report itself. Do not host evidence on external services.
  • Do not publicly disclose a vulnerability, or share any details with anyone other than authorized Atmail personnel, without Atmail’s express written permission.

Not accepted

  • Incomplete or missing SPF/DKIM/DMARC/BIMI records, including on parked or non-mail domains
  • Mail server banner or software version disclosure
  • Email spoofing claims without a bypass of an enforced control
  • “Self” XSS and “self” exploitation; issues requiring unlikely user interaction
  • Clickjacking/UI redressing on pages with no sensitive state-changing actions
  • Login/logout/unauthenticated CSRF and CSRF with minimal security impact
  • Open redirects without additional demonstrated impact; reflected file download
  • Tabnabbing, content spoofing, text injection; Flash-based anything
  • HTTP Host header XSS; autocomplete attributes on web forms
  • CSV injection
  • Missing security HTTP headers; missing cookie flags; CSP preferences
  • SSL/TLS configuration best practices; use of known-vulnerable library versions without a working exploit in our deployment
  • Verbose error pages; software version disclosure; account/email enumeration without demonstrated PII exposure
  • Most rate-limiting issues; general best-practice concerns
  • Results of automated scanners without verification
  • Denial of service; physical attacks; social engineering
  • Internal pivoting, scanning, exploiting, or data exfiltration beyond minimal PoC
  • Issues in third-party services, or anything that resolves to third-party infrastructure

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 6 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2024-24133 Critical 9.8 7 Feb 2024
CVE-2022-31200 Medium 6.1 27 Jul 2023
CVE-2022-30776 Medium 6.1 16 May 2022
CVE-2021-43574 Medium 6.1 15 Nov 2021
CVE-2012-2593 Medium 6.1 6 Feb 2020
CVE-2017-11617 Medium 6.1 25 Jul 2017
CVE-2017-9517 High 8.8 8 Jun 2017
CVE-2017-9518 High 8.8 8 Jun 2017
CVE-2017-9519 High 8.8 8 Jun 2017
CVE-2013-2585 Medium 4.3 12 Feb 2014
CVE-2013-6229 Medium 4.3 12 Feb 2014
CVE-2013-5031 High 10.0 12 Jan 2014
CVE-2013-5032 High 10.0 12 Jan 2014
CVE-2013-5033 High 10.0 12 Jan 2014
CVE-2013-5034 High 10.0 12 Jan 2014
CVE-2013-6017 Medium 4.3 12 Jan 2014
CVE-2013-6028 Medium 6.8 12 Jan 2014
CVE-2012-1919 Medium 6.4 27 Mar 2012
CVE-2012-1920 Medium 5.0 27 Mar 2012
CVE-2012-1916 High 7.5 27 Mar 2012
CVE-2012-1917 Medium 5.0 27 Mar 2012
CVE-2012-1918 Medium 5.0 27 Mar 2012
CVE-2011-4540 Medium 4.3 1 Dec 2011
CVE-2010-4930 Medium 4.3 9 Oct 2011
CVE-2009-2455 Medium 4.3 14 Jul 2009
CVE-2007-2825 Medium 4.3 22 May 2007
CVE-2007-2153 Medium 6.8 19 Apr 2007
CVE-2007-0953 Medium 4.3 15 Feb 2007
CVE-2006-6701 High 7.5 23 Dec 2006
CVE-2006-6702 Medium 6.8 23 Dec 2006
CVE-2006-6704 Medium 6.8 23 Dec 2006
CVE-2006-0611 High 7.5 9 Feb 2006