- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
The responsible team decides whether to award a bounty and its amount.
- Safe harbor
-
Full
We consider good-faith research conducted within this policy authorized and will not pursue legal action solely for that compliant research.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test, 1 excluded.
Android apps 2
- https://play.google.com/store/apps/details?id=email.clean.android
- The official Clean Email Android application
iOS apps 2
- https://itunes.apple.com/us/app/clean-email/id1219660920?mt=8
- The official Clean Email iOS and iPadOS applications
Domains 1
- app.clean.email
Out of scope (1)
- Other websites, subdomains, administrative systems, and third-party services are not automatically included.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Clean Email's policy. "We" in these lines means the program, not this site.
While testing
-
Use accounts, mailboxes, and data you own or have explicit permission to use. Keep testing minimal.
-
If you unexpectedly encounter another person’s data, stop testing and notify us promptly. Do not continue accessing, retaining, or sharing it.
-
Do not generate substantial charges, exhaust quotas, or repeatedly invoke billable services. Contact us before testing if verification could incur costs.
-
Report privately before publishing details. Allow at least 90 days from receipt for investigation and remediation, unless we agree to earlier disclosure.
-
Never publish customer information, active credentials, or other confidential data obtained during research.
-
Edited, modified, or AI-generated videos will immediately disqualify your report.
Not accepted
-
Missing security headers, certificate pinning, root detection, or jailbreak detection.
-
App Transport Security exceptions, permissive transport settings, or debugging features.
-
JavaScript enabled in a WebView or the presence of a native bridge.
-
Exported mobile components performing their intended public function.
-
Information stored in application-private storage.
-
Serialization, deserialization, or database APIs without a demonstrated exploitable input.
-
Public client configuration, project identifiers, or API keys.
-
Dependency warnings or known vulnerabilities without evidence that Clean Email is affected.
-
Self-exploitation that cannot affect another account or user.
-
Attacks assuming an already compromised account, rooted device, or authorized debugging access without demonstrating an additional security boundary crossed.
-
Any attack requiring physical control of the victim’s device.
-
“Tehoretical” or “possible” attack vectors do not qualify as a viable report.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− Clean Email Web App, − Clean Email Android App, − Clean Email iOS and iPadOS Apps
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.