Celtra

Bug bounty on security.txt celtra.com

Accepting reports Full safe harbor security.txt

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash: Yes Eligibility for any monetary compensation is limited to the first person to report an unknown issue. We would usually offer a bounty based on the severity score.
Safe harbor: Full If you make a good faith effort to comply with the program rules during your security research, we will consider your research to be authorized. We will try to work with you to understand and resolve the issue quickly, and Celtra will not recommend or pursue any legal action related to your research

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

13 assets you may test.

What the policy asks of you, and the bug types it won't reward, quoted from Celtra's policy. "We" in these lines means the program, not this site.

Never use a finding to compromise/exfiltrate data or pivot to other systems. Use a proof of concept only to demonstrate an issue.
If sensitive information, such as personal information, credentials, etc., is accessed as part of a vulnerability, it must not be saved, stored, transferred, accessed, or otherwise processed after initial discovery.
Researchers may not, and are not authorized to engage in any activity that would be disruptive, damaging or harmful to Celtra, its brands, customers, employees or its users.
please do not attempt to carry out DoS attacks, leverage black hat SEO techniques, spam people, or do other similarly questionable things.
Your testing must not violate any law.
Celtra will not give you any access to our systems to conduct white hat research.

Any physical attack against the user's device, Celtra property or its data host providers
Social engineering of Celtra staff or contractors
Configuration issues on end-users' machines. (for example, password storage or cache settings)
Attacks requiring a Man-in-the-Middle, with no other possible exploitation
Attacks affecting only the users of outdated browsers, plugins or OS
Non-maximal DNS configuration, such as email policy in SPF, DKIM, DMARC records, or non-use of DNSSEC
Issues involving weaker SSL/TLS cipher suites
Missing security flags in cookies, except for session cookies
Non-use of optional HTTP security headers without a demonstrable security impact
DDoS or other volumetric attacks requiring large traffic volumes
Ability to discover platform users by email addresses
Open redirectors
Reflected file download
CSV Excel formula injection
Lack of HTML sanitization where data is not intended to be rendered as HTML
Campaign preview is accessible if Campaign ID is known
Auth service API keys visible
Logout CSRF
Clickjacking
Issues that result in Denial of Service (DoS)
Commonly reported SSL/TLS vulnerabilities
SPF softfail (~all) policy
Issues related to software or protocols not under Celtra control
Issues without clearly identified security impact

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 3 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Valid until 30 Jun 2030

Read the file Among the top 4,000 websites

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake