Automox
Bug bounty on Self-hosted automox.com
- Top reward
- $5,000
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 7
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- top reward, from $100.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Paid by electronic payments
- Proof of identity needed to get paid.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$5,000
Monetary rewards for qualifying findings will range from $100 to $5000.
- Lowest reward
-
$100
Monetary rewards for qualifying findings will range from $100 to $5000.
- Response
-
Within 3 days
We will strive to fully triage your report within 3 business days.
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this program will be considered authorized conduct and we will not initiate legal action against you.
- Hall of fame
-
Yes
We will recognize your findings if you are the first to report a unique and significantly impactful vulnerability through the VDP.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 12 excluded.
Domains 1
- automox.com
Wildcard domains 1
- *.automox.com
Out of scope (12)
- community.automox.com
- developer.automox.com
- discover.automox.com
- help.automox.com
- insiders.automox.com
- listen.automox.com
- msp.automox.com
- partners.automox.com
- security.automox.com
- training.automox.com
- university.automox.com
- Domains registered to Automox but hosted by a third party
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Automox's policy. "We" in these lines means the program, not this site.
While testing
-
You must provide a working Proof of Concept (PoC).
-
Use only [email protected] to submit reports and communicate with Automox regarding your findings.
-
Be sure to include all occurrences of the same finding in one report instead of submitting them as multiple reports.
-
Do not discuss vulnerabilities outside of the VDP without express consent from Automox.
-
Do not intentionally view, store, modify, or destroy data that does not belong to you.
-
Do not engage in social engineering or phishing of customers or employees.
-
Do not engage in disruptive testing like DoS/DDoS, or anything that has a realistic potential to diminish the quality of Automox's services or disrupt the experience of our customers.
-
Do not engage in testing using anything other than test accounts.
-
Do not violate any laws or breach the Automox Master Services Agreement to discover vulnerabilities.
-
You must adhere to in scope and out of scope systems and services (see below).
Not accepted
-
Denial of Service (DoS).
-
Descriptive or verbose error pages without proof of exploitability or obtaining sensitive information.
-
Content spoofing and/or text injection findings without showing an attack vector.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Clickjacking on pages with no sensitive actions.
-
Output from Automated Scanners without a PoC to demonstrate a specific vulnerability.
-
Google Maps API Keys
-
Findings that require unlikely user interaction by the victim.
-
Findings related to password/credential strength, length, lockouts, or lack of brute-force/rate-limiting protections.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Vulnerabilities only affecting users of outdated or unpatched browsers.
-
Informational disclosure of non-sensitive data.
-
Software version disclosure / Banner identification findings.
-
Missing best practices in Content Security Policy.
-
Missing best practices in SSL/TLS configuration.
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.).
-
Rate limiting or brute-force findings on non-authentication endpoints.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2022-36122 | The Automox Agent before 40 on Windows incorrectly sets permissions on key files. | High 7.8 | 21 Oct 2022 |
| CVE-2022-27904 | Automox Agent for macOS before version 39 was vulnerable to a time-of-check/time-of-use (TOCTOU) race-condition attack during the agent install process. | High 7.0 | 1 Jul 2022 |
| CVE-2022-24308 | Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive information during the install process. | Medium 5.5 | 13 Apr 2022 |
| CVE-2021-43326 | Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory. | High 7.8 | 15 Dec 2021 |
| CVE-2021-43325 | Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. NOTE: this issue exists because of a CVE-2021-43326 regression. | High 7.8 | 15 Dec 2021 |
| CVE-2021-26908 | Automox Agent prior to version 31 logs potentially sensitive information in local log files, which could be used by a locally-authenticated attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent. | Low 3.3 | 23 Apr 2021 |
| CVE-2021-26909 | Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent. | Low 3.7 | 23 Apr 2021 |