- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs, from $50.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
| High |
|
$1,000 |
| Medium |
|
$250 |
| Low |
|
$50 |
- Top reward
-
$5,000
Critical │ $5,000
- Lowest reward
-
$50
Low │ $50
- Response
-
Within 2 days
Range acknowledges reports within 2 business days.
- Safe harbor
-
Full
Range will not pursue legal action against researchers who:
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 7 excluded.
Domains 5
- api.range.org
- app.range.org
- explorer.money
- explorer.range.org
- range.org
APIs 1
- APIs (Risk, Data, Platform)
Wildcard domains 1
- *.range.org
Products and areas 4
- Any Range-owned host or IP that is unintentionally exposed to the public internet, including internal domains and infrastructure leaking data
- Authentication and authorization flows
- Range platform
- Range platform, APIs (Risk, Data, Platform), and dashboards
Out of scope (7)
- stage.range.org
- Denial of service (DoS/DDoS) and volumetric testing
- Issues in third-party services we do not control
- Social engineering, phishing, or physical attacks
- stage.range.org and other non-production environments
- Third-party SaaS we do not operate, including HubSpot, marketing automation, our support desk, status page, and CDN. Report those to the vendor
- www.range.org and other marketing, blog, or campaign pages, including forms and pages served by third-party platforms such as HubSpot
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Range's policy. "We" in these lines means the program, not this site.
While testing
-
Submit only to [email protected] . Reports sent through sales contact forms, support channels, social media, or employee inboxes are not eligible for a reward
-
Do not submit test or spam entries through marketing or sales forms. Doing so voids eligibility and safe harbor
-
Only the first reporter of a unique, valid finding is eligible for a reward
-
Use only your own test accounts; do not access, modify, or exfiltrate other users’ data
-
Do not run automated scanners at high volume against production systems
-
You must comply with all applicable laws and sanctions regulations
-
Do not publicly disclose the vulnerability before our team has investigated and remediated it. Do not open a public GitHub issue.
Not accepted
-
Reports from automated scanners without a working proof of concept
-
Best-practice recommendations without a demonstrable vulnerability
-
Missing security headers (CSP, HSTS, X-Frame-Options) without a demonstrated exploit
-
SPF, DKIM, or DMARC configuration issues
-
Self-XSS, clickjacking on pages without sensitive actions , and CSRF on logout or non-state-changing endpoints
-
Rate limiting or brute-force concerns without a clear impact path
-
Username or email enumeration
-
Vulnerabilities in outdated browsers or already-patched dependencies without a working proof of concept
-
Issues already known to the team or previously reported
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.