Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

CAKE.com

Bug bounty on security.txt cake.com

Accepting reports security.txt
Go to program Website
Top reward
$2,500
Top severity paid
Critical
Assets in scope
24
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $2,500
for critical bugs, from $100.
Report by email
https://security.cake.com/
Replies within 14 days
As the policy promises.
Paid by ACH, check
No identity requirement stated.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $2,500
High $1,000
Medium $500
Low $100
Top reward
$2,500 CRITICAL │ HIGH │ MEDIUM │ LOW $2,500 │ $1,000 │ $500 │ $100
Lowest reward
$100 CRITICAL │ HIGH │ MEDIUM │ LOW $2,500 │ $1,000 │ $500 │ $100
Response
Within 14 days Due to a high volume of submissions, our current estimated response time is up to 2 weeks.
Hall of fame
Yes Contributors Show contributors Specials thanks to everyone for helping us improve our system’s security.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

24 assets you may test, 17 excluded.

APIs 6

  • account.cake.com/api
  • *.api.clockify.me/api
  • *.api.developer.marketplace.cake.com
  • *.api-ga.pumble.com
  • *.api.marketplace.cake.com
  • *.api.plaky.com

Web 6

  • account.cake.com
  • app.clockify.me
  • app.plaky.com
  • app.pumble.com
  • developer.marketplace.cake.com
  • marketplace.cake.com

Domains 4

  • cake.com
  • clockify.me
  • plaky.com
  • pumble.com

Android apps 3

  • play.google.com/store/apps/details?id=com.plaky.android
  • play.google.com/store/apps/details?id=com.pumble
  • play.google.com/store/apps/details?id=me.clockify.android

iOS apps 3

  • apps.apple.com/us/app/clockify-time-tracker/id1304431926
  • apps.apple.com/us/app/plaky/id1635144609
  • apps.apple.com/us/app/pumble/id1536136725

Products and areas 2

  • addons.mozilla.org/en-US/firefox/addon/clockify-time-tracker/
  • chrome.google.com/webstore/detail/clockify-time-tracker/pmjeegjhjdlccodhacdgbgfagbpmccpe
Out of scope (17)
  • security.cake.com
  • cake.com/help/*
  • clockify.me/blog/*
  • clockify.me/help/*
  • clockify.me/learn/*
  • forum.clockify.me/
  • Other landing pages not related to the Clockify, Plaky, Pumble, Cake applications
  • plaky.com/blog/*
  • plaky.com/help/*
  • plaky.com/learn/*
  • pumble.com/blog/*
  • pumble.com/help/*
  • pumble.com/learn/*
  • *.cake.com
  • *.clockify.me
  • *.plaky.com
  • *.pumble.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from CAKE.com's policy. "We" in these lines means the program, not this site.

While testing

  • Report security issues exclusively via the form which is monitored by our security team.
  • Be the first person to report the vulnerability.
  • Public disclosure of reported vulnerabilities. Disclosing a vulnerability, directly or indirectly (i.e. posting it in public video streams, listed or not), will render the associated report ineligible for bounty.
  • Do not initiate any unauthorized financial transactions
  • Do not conduct social engineering attacks (e.g. phishing, vishing, smishing) against CAKE.com employees, partners, or customers.
  • Using automated scanning tools to scan assets
  • Mass creation of users, groups, and projects
  • Deletion of any files or data
  • Modification of any files or data, including permissions

Not accepted

  • Vulnerabilities requiring physical access to the victim's unlocked device
  • Denial of Service attacks
  • Brute Force attacks
  • Spam or Social Engineering techniques
  • Content Spoofing
  • Best practices concerns
  • Issues relating to Password Policy
  • Issues relating to token lifetime
  • User enumeration
  • Full-Path Disclosure on any property
  • CSRF-able actions that do not require authentication (or a session) to exploit
  • Version number information disclosure
  • Reports related to missing security headers
  • CSV Injection
  • Reverse Tabnabbing
  • Race condition
  • Rate limit
  • Bugs that do not represent any security risk
  • Vulnerabilities that are limited to unsupported browsers
  • Improper session invalidation
  • Use of a known-vulnerable library (without evidence of exploitability)
  • Not enforcing certificate pinning
  • Pre-Account Takeover
  • Vulnerabilities in third-party products, services, add-ons, extensions, or integrations that are not developed or controlled by CAKE.com
  • Findings based solely on historical or archived content obtained through the Web Archive or similar archival services.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 3 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.