Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Bright Horizons

Vulnerability disclosure program on security.txt brighthorizons.com

Accepting reports Full safe harbor security.txt
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
13
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report through their form
hackerone.com/bright_horizons_vdp?type=team
Full safe harbor
Good-faith research is authorised; no legal action.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Safe harbor
Full Bright Horizons will not initiate a lawsuit or law enforcement investigation against you in response to reporting a vulnerability if you fully comply with this policy.
Hall of fame
No At this time, Bright Horizons does NOT maintain a public facing list of externally reported issues and reporters.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

13 assets you may test, 3 excluded.

Domains 6

  • brighthorizons.com
  • brighthorizons.co.uk
  • edassist.com
  • jovie.com
  • sittercity.com
  • steveandkatescamp.com

Wildcard domains 6

  • brighthorizons.com and all subdomains (*.brighthorizons.com)
  • brighthorizons.co.uk and all subdomains (*.brighthorizons.co.uk)
  • edassist.com and all subdomains (*.edassist.com)
  • jovie.com and all subdomains (*.jovie.com)
  • sittercity.com and all subdomains (*.sittercity.com)
  • steveandkatescamp.com and all subdomains (*.steveandkatescamp.com)

APIs 1

  • Any API endpoints hosted on any of the above domains
Out of scope (3)
  • Any systems or services not expressly listed above
  • Bright Horizons offices, employees, equipment
  • third-party applications, websites or services that integrate with or link to Bright Horizons applications

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Bright Horizons's policy.

While testing

  • If you work for a Bright Horizons client, you are prohibited from conducting any testing under this program.
  • Do not interact with an enterprise and/or personal Bright Horizons account that you don't own (such as by modifying or accessing data from the account).
  • Do not access or attempt to access data that does not belong to you.
  • Do not exploit a security issue you discover for any reason.
  • Do not conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure and employees of Bright Horizons.
  • Do not test the physical security of Bright Horizons offices, employees, equipment, etc.
  • Do not use a finding to compromise/exfiltrate/modify/destroy data or to pivot to other systems. Use a proof of concept only to demonstrate an issue.
  • Do not test third-party websites, applications, or services that integrate with Bright Horizons services without their permission.
  • Use of automated tools and scanners is prohibited.
  • If possible, use X-BugBounty header in your testing requests.

Not accepted

  • Issues with public contact forms or support forms. Testing of those forms is prohibited
  • Password leaks found on the internet, or credential stuffing attacks
  • Attacks requiring physical access to a users device
  • Phishing
  • Disclosure of known public files or directories (e.g., robots.txt)
  • Missing DNS records (e.g.MX, DMARC, SPF)
  • Banner disclosure on common/public services
  • HTTP/TLS configuration issues without demonstrable impact
  • Lack of Secure/HTTPOnly flags on non-sensitive cookies
  • CSP, Security header configuration suggestions
  • Presence of application or web browser 'autocomplete' or 'save password' functionality
  • CSRF on forms that are available to anonymous users
  • Username enumeration on login or forgot password pages
  • Rate limit bypasses where throttling is not in place
  • Unauthenticated cache purge
  • API key disclosure without proven business impact
  • Self-XSS that cannot be used to exploit other users
  • Absence of password length limits
  • Bypassing rate-limits or the non-existence of rate-limits
  • Host header injection without proven business impact
  • Attacks requiring man-in-the-middle or compromised user accounts
  • Cookie bomb DoS
  • CORS issues on APIs

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 12 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.