- Top reward
- $1,000
- Top severity paid
- Critical
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $1,000
- for critical bugs.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 10 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$1,000 |
| High |
|
$500 |
| Medium |
|
$200 |
- Top reward
-
$1,000
Critical $1000
- Response
-
Within 10 days
Acknowledge and triage all valid reports within 10 business days
- Safe harbor
-
Partial
Activities conducted in compliance with this program are considered authorized under applicable computer misuse laws.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test, 1 excluded.
APIs 1
- Aurasell APIs
Domains 1
- aurasell.ai
Products and areas 3
- Aurasell administrative consoles
- Aurasell web applications
- Other Aurasell-owned production services
Out of scope (1)
- Third-party hosted systems unless they directly impact Aurasell
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Aurasell Inc.'s policy.
While testing
-
Allow Aurasell reasonable time to investigate and remediate reported vulnerabilities before any public disclosure.
-
Do not violate user privacy or access, modify, destroy, or exfiltrate data.
-
Do not disrupt, degrade, or deny service availability.
-
Do not exploit vulnerabilities beyond what is necessary to demonstrate their existence.
-
You are not authorized to access user data, personal data, or internal company data.
-
Only test accounts you personally own and control.
-
Do not target physical security, use social engineering, spam, or perform DDoS attacks.
-
If a vulnerability provides system-level access, stop testing immediately and report it.
-
Disclosure to any party other than Aurasell is strictly prohibited.
-
All proof-of-concept artifacts (code, screenshots, videos) must be destroyed after the report is closed.
Not accepted
-
Open redirects without serious impact
-
Clickjacking
-
Cache poisoning
-
Content spoofing
-
Missing SPF, DKIM, or DMARC records
-
Brute-force attacks
-
Non-reproducible issues
-
Missing rate limiting
-
Denial-of-Service (DoS / DDoS) attacks
-
CSRF with minimal or no impact
-
Stack traces or path disclosures
-
Vulnerabilities requiring Man-in-the-Middle (MITM) attacks
-
Theoretical subdomain takeovers without evidence
-
Self-inflicted vulnerabilities by merchants
-
Missing HSTS
-
Issues affecting outdated or unsupported browsers or operating systems
-
Informational security headers or version banners
-
Physical attacks, social engineering, phishing, spam, or DDoS-related issues
-
Previously reported or known vulnerabilities
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.