- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- https://dennisbabkin.com/contact
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Paid by PayPal, Bitcoin
- No identity requirement stated.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
I will personally thank you with a monetary reward if you responsibly disclose to us an "in-scope" vulnerability
- Safe harbor
-
Full
we will hold you harmless of any legal actions as long as you follow the "in-scope" rules outlined on this page
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 4 excluded.
Desktop and binaries 1
- Any PE executable file (with extensions: .exe , .dll , .scr , .msi , etc.) that is digitally signed by our code signing certificate
Domains 1
- dennisbabkin.com
Products and areas 1
- Any PE executable file (with extensions
Out of scope (4)
- Binary executables that are not hosted on our website that we cannot update with a fix.
- Binary executables that are not signed by us, even though they may bear our name
- Older versions of our software that have explicit warnings of an increased risk to the end-user
- Schedulers that execute arbitrary commands.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from dennisbabkin.com's policy. "We" in these lines means the program, not this site.
While testing
-
Do not disclose reported vulnerability in a public setting for the duration of time that it will take us to fix it.
-
Never publicly expose personal or private information of the end-users that was involved in the vulnerability/leak.
-
Don't "hoard" similar bugs.
-
Use of any automated scripts to probe or load repeatedly any pages of our website is not allowed.
-
Employ social engineering, phishing, spam, malware, or any similar means to elicit access to our resources is not allowed.
-
we do not allow you to publish extensive details of such research in any public setting.
-
Disclosure of any trade secrets and know-hows obtained from your reverse-engineering research of our software is not allowed.
Not accepted
-
Any bugs in the rendering of client-side HTML and JavaScript that do not expose end-user data, or "trick" them into redirecting to a malicious website.
-
Bugs and anomalies that are not repeatable or reproducible.
-
Any occurrence of an unusual website behavior that takes place during a temporary update, maintenance or service outage.
-
If our website's client-side code is modified (en-route) by an ISP, by an anti-virus software, or by a firewall.
-
A vulnerability that thwarts or hinders the performance of our website (excluding denial-of-service or similar persistent scripting attacks.)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.