- Top reward
- $4,000
- Top severity paid
- Critical
- Assets in scope
- 20
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $4,000
- for critical bugs, from $50.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$4,000 |
| High |
|
$2,000 from $1,000 |
| Medium |
|
$1,000 from $500 |
| Low |
|
$500 from $100 |
| Informational |
|
$150 from $50 |
- Top reward
-
$4,000
Critical │ High │ Medium │ Low │ Info $4000 │ $1000 – $2000 │ $500 – $1000 │ $100 – $500 │ $50 – $150
- Lowest reward
-
$50
Critical │ High │ Medium │ Low │ Info $4000 │ $1000 – $2000 │ $500 – $1000 │ $100 – $500 │ $50 – $150
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct, and we will not initiate legal action against you.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
20 assets you may test, 3 excluded.
Domains 8
- cleanshot.cloud
- cleanshot cloud and cleanshot license management web apps, backend and infrastructure
- cleanshot.com
- cln.sh
- legit.maketheweb.io
- licenses.cleanshot.com
- share.cleanshot.com
- updates.getcleanshot.com
Wildcard domains 8
- *.cleanshot.cloud
- *.cleanshot.cloud/*
- cleanshot.com/*
- cln.sh/*
- legit.maketheweb.io/*
- licenses.cleanshot.com/*
- share.cleanshot.com/*
- updates.getcleanshot.com/*
Products and areas 4
- Any custom domain you connect in Advanced settings on a Pro account.
- CleanShot X macOS app
- S3 buckets, CloudFront distributions, and other asset URLs referenced by the domains above, where the context indicates that we own and operate them.
- The latest version of CleanShot X desktop app downloaded from cleanshot.com or installed through Setapp.
Out of scope (3)
- docs.cleanshot.com
- status.cleanshot.com
- Custom domains of other customers that you did not connect yourself.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from CleanShot's policy. "We" in these lines means the program, not this site.
While testing
-
Each report must demonstrate a real security vulnerability affecting the confidentiality, integrity, or availability of the service.
-
Each report must include the steps necessary to reproduce the issue (Proof of Concept).
-
Provide us with enough time to resolve the issue before making any information public.
-
Multiple vulnerabilities caused by the same underlying issue will be awarded one bounty.
-
In case multiple researchers report the same vulnerability, only the first report will be rewarded.
-
Respect user privacy. Do not access user data beyond what is necessary to demonstrate the vulnerability. Do not post comments under other users' content. Do not modify or delete data that does not belong to you.
-
Social engineering or phishing of CleanShot employees or contractors.
-
Physical attacks against CleanShot personnel or infrastructure.
-
Brute forcing directories or subdomains with automated tools like DirBuster.
-
Posting comments under content uploaded by other CleanShot Cloud users or any other testing that affects real users.
Not accepted
-
Vulnerabilities requiring unlikely user interaction.
-
Well-known vulnerable software or libraries without a relevant Proof of Concept.
-
UI and UX bugs, spelling mistakes, and errors in application logic that do not have a security impact.
-
Password policy issues.
-
Rate limiting issues.
-
Simple DoS attacks. A DoS attack is only in scope if a vulnerability allows an attacker to consume significant resources with a small number of requests.
-
Intended behavior of the application.
-
User enumeration.
-
Unsafe token storage without demonstrating a practical attack.
-
Reports based on comments posted under other users' content are not eligible for a reward.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.