Contentsquare
Bug bounty on security.txt contentsquare.com
- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
If the report is valid, we’ll invite you to our bug bounty program on YesWeHack and you’ll be rewarded according to the severity of the finding.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test.
Domains 1
- contentsquare.com
Wildcard domains 1
- any subdomains on contentsquare.com
Products and areas 1
- Services that Contentsquare provides
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Contentsquare's policy. "We" in these lines means the program, not this site.
While testing
-
Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue (please reach us at [email protected])
-
Provide us with a reasonable amount of time to understand, analyze and resolve the issue
-
No vulnerability disclosure to any third-parties, including partial is allowed without formal acknowledgement of Contentsquare staff
-
You must be the first reporter of a vulnerability and the vulnerability must be a qualifying vulnerability
-
You must not be a former or current employee of Contentsquare or one of its contractor
-
You must send a clear textual description of the report along with steps to reproduce the issue (include attachments such as screenshots or proof of concept code as necessary)
-
If you find the same vulnerability several times, please create only one report and eventually use comments.
Not accepted
-
Anything not listed in the qualifying vulnerabilities
-
Attacks requiring physical access to a user's device
-
Exploits that are only possible on Android version 7 and below
-
Exploits that are only possible on IOS version 10 and below
-
Exploits that are only possible on a jailbroken device
-
Lack of code obfuscation
-
Lack of binary protection / jailbreak and root detection / anti-debugging controls
-
Attacks which consider a prerequisite the compromission of the user's device (e.g. by a local malware)
-
Crashing your own application
-
Exploits that are only possible on a rooted/jailbroken device
-
Exploiting a generic Android or iOS vulnerability
-
Any attack requiring a social-engineering step
-
Component CVE without exploitable POC
-
Login, logout, unauthenticated or low-value CSRF
-
Vulnerabilities affecting users of outdated browsers and platforms
-
Self XSS, reflected XSS and "HTTP Host Header" XSS
-
Open redirect
-
Reports of insecure SSL/TLS ciphers (unless you have a working proof of concept)
-
Mixed content warnings
-
Brute force / password reuse attacks
-
User enumeration attacks
-
Recently (15 days) disclosed 0-day vulnerabilities
-
Denial of service
-
Missing cookie flags on non-sensitive cookies
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.