- Top reward
- $2,500
- Top severity paid
- Critical
- Assets in scope
- 16
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $2,500
- for critical bugs, from $50.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$2,500 from $1,500 |
| High |
|
$1,500 from $500 |
| Medium |
|
$500 from $50 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $2,500
Scope
16 assets you may test, 1 excluded.
Web 9
- https://clients.multiplayer.classdojo.com/launcher/prod/latest
- https://dev.tutoring.classdojo.com
- https://home.classdojo.com
- https://monster-customizer.classdojo.com/cf6dfa68-1a81-4c6d-bc0b-38f3666b37d6/index.html
- https://student.classdojo.com
- https://teach.classdojo.com
- https://ticket.multiplayer.classdojo.com
- https://ws.multiplayer.classdojo.com
- https://www.classdojo.com
Wildcard domains 4
- *.classdojo.com
- *.classdojo.co.uk
- *.doj.io
- *.dojo.me
Android apps 1
- https://play.google.com/store/apps/details?id=com.classdojo.android
APIs 1
- https://api.classdojo.com
iOS apps 1
- https://apps.apple.com/us/app/classdojo/id552602056
Out of scope (1)
- https://shop.classdojo.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from ClassDojo (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
Share the details of the security vulnerabilities with us exclusively via Bugcrowd tools
-
Give us reasonable amount of time to acknowledge, research, and implement fix for the issues when applicable, before any public disclosure
-
Use your own testing accounts and not modify, access, or affect other users' accounts and account information in any way
-
Do not use automated tools that could potentially degrade the performance of our service
-
Do not permanently modify or delete ClassDojo-hosted data.
-
Do not intentionally access non-public ClassDojo data any more than is necessary to demonstrate the vulnerability.
-
Do not DDoS or otherwise disrupt, interrupt or degrade our internal or external services.
-
Do not share confidential information obtained from ClassDojo, including but not limited to member or - donor payment information, with any third party.
-
You are required to add an identifying user-agent string to the header of your requests: [UA-BUGCROWD]
-
Additionally, the ClassDojo program limits the use of automated scanners to one request a second.
Not accepted
-
Vulnerabilities affecting users of outdated browsers or platforms
-
Vulnerabilities affecting users of rooted mobile devices
-
Use of a known-vulnerable library which does not lead to a vulnerability in our service
-
Forms missing CSRF tokens which do not lead to a vulnerability
-
Missing SPF/DKIM/DMARC records
-
Insecure SSL/TLS ciphers which do not lead to a vulnerability
-
Cookies missing secure flag
-
Missing security headers which do not lead to a vulnerability
-
Reports from automated tools or scans
-
Password and account recovery policies, such as reset link expiration, password complexity, and session lifecycle.
-
Email spam from user actions, e.g. no rate limits on invitations
-
Denial of service vulnerabilities
-
Stack traces or file-path exposure
-
Mobile vulnerabilities requiring users to be tricked into installing an unrelated malicious application.
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 13 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://monster-customizer.classdojo.com/cf6dfa68-1a81-4c6d-bc0b-38f3666b37d6/index.html
-
Scope added
https://clients.multiplayer.classdojo.com/launcher/prod/latest
-
Scope added
https://shop.classdojo.com (out of scope)
-
Scope added
*.dojo.me
-
Scope added
*.doj.io
-
Scope added
*.classdojo.co.uk
-
Scope added
*.classdojo.com
-
Scope added
https://ticket.multiplayer.classdojo.com
-
Scope added
https://ws.multiplayer.classdojo.com/
-
Scope added
https://dev.tutoring.classdojo.com
-
Scope added
https://home.classdojo.com
-
Scope added
https://www.classdojo.com
-
Scope added
https://student.classdojo.com
-
Scope added
https://teach.classdojo.com
-
Scope added
https://play.google.com/store/apps/details?id=com.classdojo.android
-
Scope added
https://api.classdojo.com
-
Scope added
https://apps.apple.com/us/app/classdojo/id552602056
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
ClassDojo is committed to working with security experts across the world to stay up to date with the latest security techniques and to protect the information entrusted to us by our users. If you have discovered a security issue that you believe we should know about, we'd welcome working with you. We will make every effort to acknowledge and address security issues as fast as possible. Good luck and happy hunting! Eligibility When you are investigating and reporting, we ask that you: Share the details of the security vulnerabilities with us exclusively via Bugcrowd tools Give us reasonable amount of time to acknowledge, research, and implement fix for the issues when applicable, before any public disclosure Use your own testing accounts and not modify, access, or affect other users' accounts and account information in any way Do not use automated tools that could potentially degrade the performance of our service While we welcome reports about best practices, unless a report leads to an exploit that materially affects the security and privacy of ClassDojo users, it will not be eligible for a bounty. Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact (see below). In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Any domain/property of ClassDojo not listed in the targets section above is out of scope. This includes any/all subdomains not listed above. Access All targets are publicly accessible. Please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . When setting up your account, please set your school to be the 'Bugcrowd testing school'. You are required to add an identifying user-agent string to the header of your requests: [UA-BUGCROWD] Additionally, the ClassDojo program limits the use of automated scanners to one request a second. Failure to follow these guidelines could result in removal from the program. High-Level Overview In order to understand how we evaluate impact you must first understand user types and group types. User Types ClassDojo has the following user types: School Leader / Admin Teacher Parent Student Group Types School Class User & Group Relationships School Leaders/Admins "own" a school Classes can belong to either a school or a teacher or both Note: it is possible for a class to not belong to a school Teachers are connected to a school and to classes they are added as collaborators to Teachers "own" classes they've created or are assigned ownership of by a School Leader Students are connected to schools or to classes or both Parents are connected to students via class/school, or "at home" Notes on Impact The highest severity bugs for ClassDojo are those bugs where a user is able to read or modify data across a connection boundary, especially if that data is considered PII. For example, a teacher can read/write private data to classes outside their school. Similarly high impact are any vulnerabilities that allow parents to read/write private data to students/children they are not connected to. Generally speaking, if you identify a vulnerability that lets you read/write to an object using an object identifier, we will consider the impact higher if you're able to enumerate the identifier and encourage you to look for such enumeration as a part of your research process. While we want to know about vulnerabilities across class boundaries within a school (e.g. a teacher can read/write on a class in their school even if they are not connected to that class as a co-teacher), this type of vulnerability will always be lower impact than the same vulnerability across schools Lastly, we generally do not consider a mismatch between UI and API to have security impact as we often will make changes to the API first for features we intend to add in future UI updates. Guidelines Please adhere to the following guidelines in order to be eligible for rewards under this program: Do not permanently modify or delete ClassDojo-hosted data. Do not intentionally access non-public ClassDojo data any more than is necessary to demonstrate the vulnerability. Do not DDoS or otherwise disrupt, interrupt or degrade our internal or external services. Do not share confidential information obtained from ClassDojo, including but not limited to member or - donor payment information, with any third party. Out-of-Scope These categories of vulnerabilities are not covered in our reward program: Vulnerabilities affecting users of outdated browsers or platforms Vulnerabilities affecting users of rooted mobile devices Use of a known-vulnerable library which does not lead to a vulnerability in our service Forms missing CSRF tokens which do not lead to a vulnerability Missing SPF/DKIM/DMARC records Insecure SSL/TLS ciphers which do not lead to a vulnerability Cookies missing secure flag Missing security headers which do not lead to a vulnerability Reports from automated tools or scans Password and account recovery policies, such as reset link expiration, password complexity, and session lifecycle. This includes (but is not limited to): not logging out other sessions when a user changes a password, not requiring an existing password to change a password, sessions not getting logged out when there is an extended amount of inactivity, deleting an account while logged in without a password, receiving email confirmation when you've updated your email, etc.) Email spam from user actions, e.g. no rate limits on invitations Denial of service vulnerabilities Stack traces or file-path exposure Mobile vulnerabilities requiring users to be tricked into installing an unrelated malicious application. (e.g. Strandhogg, etc.) Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.
In Scope (Discovery Targets) (in scope)
ClassDojo welcomes testing against the listed targets beyond what is listed explicitly in other sections. For the time being, only points will be rewarded for bugs found against these targets.
Out of Scope (out of scope)
These URL paths are out of scope.