- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs, from $250.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
| High |
|
$2,000 |
| Medium |
|
$750 |
| Low |
|
$250 |
- Top reward
-
$5,000
Critical │ 9.0 – 10.0 │ $5,000
- Lowest reward
-
$250
Low │ 0.1 – 3.9 │ $250
- Response
-
Within 2 days
acknowledge your report within 2 business days;
- Safe harbor
-
Full
We consider security research and vulnerability disclosure carried out in good faith and in line with this policy to be authorized conduct. We will not initiate or recommend legal action against you for accidental, good-faith violations of this policy, and we will treat your research as authorized u
- Hall of fame
-
Yes
With your consent, we recognize everyone who reports a valid, in-scope vulnerability here.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 8 excluded.
Web 2
- https://beyondmemory.io
- https://www.beyondmemory.io
Out of scope (8)
- api.web3forms.com
- All other hosts and subdomains (for example, anything under *.beyondmemory.io)
- Cloudflare
- hCaptcha, *.hcaptcha.com
- our email and DNS providers
- our product, application, customer portal, APIs, and any staging, development, or internal infrastructure
- Web3Forms, api.web3forms.com
- *.hcaptcha.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from beyondmemory's policy. "We" in these lines means the program, not this site.
While testing
-
Test only against the in-scope hosts listed above.
-
Use only your own accounts and test data. Do not interact with, access, modify, or destroy data that does not belong to you.
-
If you encounter any personal, confidential, or sensitive data, stop immediately, do not download or keep it, and tell us in your report.
-
A single proof of concept, such as a screenshot, is enough. Do not pivot, escalate, or exfiltrate beyond what is necessary to demonstrate the issue.
-
Do not run high-volume automated scans against our infrastructure.
-
Do not test, or pivot to, any out-of-scope host or service.
-
Comply with all applicable laws, and keep the details of any vulnerability confidential until we have had a reasonable opportunity to remediate it (coordinated disclosure).
Not accepted
-
Denial-of-service (DoS or DDoS), volumetric, stress, load, or brute-force testing of any kind.
-
Absence of rate limiting, absence of CAPTCHA, or account and email enumeration without a concrete, demonstrated security impact.
-
Missing security headers, missing cookie flags, and other best-practice configuration findings without a working, demonstrated exploit.
-
Clickjacking on pages that have no sensitive, state-changing action.
-
Self-XSS, and issues that require an unlikely amount of user interaction or a non-default browser configuration.
-
Output from automated scanners or tools without manual validation and a working proof of concept.
-
Social engineering, phishing, or vishing of our staff, customers, or vendors; physical attacks; and attacks that require physical access to a device.
-
Theoretical email spoofing, or SPF, DKIM, and DMARC findings, without a working and impactful exploit.
-
TLS or SSL configuration and cipher-suite preferences without a concrete exploit.
-
Publicly documented, by-design behavior, including the public, domain-restricted form access key that is embedded in the page by design.
-
Tabnabbing, verbose error pages, software version disclosure, and similar low-impact informational findings.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.