- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
We do not currently offer monetary rewards for vulnerability disclosure (i.e. in the form of a "bug-bounty" programme)
- Response
-
Within 5 days
After submitting your vulnerability report to us, a member of our team will respond to you within 5 working days.
- Hall of fame
-
No
we will publicly credit the reporter in our release notes and in any public documentation about the vulnerability.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test.
Domains 1
- clamxav.com
Products and areas 1
- any products, infrastructure or web services developed and maintained by us
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Canimaan Software Ltd's policy. "We" in these lines means the program, not this site.
While testing
-
Break any applicable law in your research or exploitation of the vulnerability.
-
Unlawfully access unecessary, excessive or significant amounts of data generated by or about the Company.
-
Make modifications to the Company's systems or services.
-
Use high-velocity, wide-reaching or invasive scanning tools in an attempt to discover vulnerabilites.
-
Make use of any tooling or techniques which could cause disruption to systems owned by the Company or prevent business continuity.
-
Attempt to report vulnerabilites to us in an insecure manner or using methods not defined in our security.txt.
-
Make any demands to the Company or impose conditions on the disclosure of the vulnerability.
-
Take action to secure any data about the vulnerability during the disclosure period.
Not accepted
-
Report non-exploitable vulnerabilities or fail to provide a proof of concept exploit.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.