- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
Scope
1 asset you may test, 8 excluded.
Products and areas 1
- All Docusign apps and assets not listed below as Out of Scope Critical No bounty
Out of scope (8)
- https://admin.docusign.com
- https://app.docusign.com
- https://partners.docusign.com
- https://www.docusign.net/signing
- *.account.docusign.com
- www.docusign.net/api/3.0/*
- www.docusign.net/restapi/*
- www.rooms.docusign.com/*
Rules
What the policy asks of you, and the bug types it won't reward, quoted from DocuSign (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
DO NOT carry out attacks that affect the data of other customers' accounts.
-
DO NOT carry out attacks or perform any testing in our production environment.
-
Any automated tools or scanners used to find vulnerabilities must be heavily rate limited.An appropriate rate is considered to be no more than 2-3 requests per second.
-
Please provide the account ID and email address used during testing. If the vulnerability involves an envelope, please include the envelope ID as well.
-
Include clear reproduction steps. You may send a video for clarity, but we need clear step-by-step written instructions.
Not accepted
-
Subdomain takeovers with PoCs that don't simply state: "This is a temporary landing page, please proceed to www.docusign.com".
-
Attacks related to stolen credentials.
-
Phishing, social engineering, and any other non-technical attacks.
-
No denial-of-service attacks and load testing.
-
Uploading or downloading malicious files (e.g., word macros, viruses, etc.)
Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://www.docusign.net/api/3.0/* (out of scope)
-
Scope added
https://www.rooms.docusign.com/* (out of scope)
-
Scope added
https://*.account.docusign.com/ (out of scope)
-
Scope added
https://admin.docusign.com (out of scope)
-
Scope added
https://app.docusign.com/ (out of scope)
-
Scope added
https://partners.docusign.com (out of scope)
-
Scope added
All Docusign apps and assets not listed below as Out of Scope
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
##Testing Method Exclusions
- DO NOT carry out attacks that affect the data of other customers' accounts.
- DO NOT carry out attacks or perform any testing in our production environment.
- Uploading or downloading malicious files (e.g., word macros, viruses, etc.)
- Any automated tools or scanners used to find vulnerabilities must be heavily rate limited.An appropriate rate is considered to be no more than 2-3 requests per second.
- No denial-of-service attacks and load testing.
- Phishing, social engineering, and any other non-technical attacks.
- Domains that are CNAME'd to another domain. Please contact their program if you find an issue.
- Subdomain takeovers with PoCs that don't simply state: "This is a temporary landing page, please proceed to www.docusign.com".
- Attacks related to stolen credentials.
##Scope
Testing is only authorized on the targets listed as in scope. Acquisitions will be excluded from scope for the first six months following the completion of the deal. If you happen to identify a security vulnerability on a target that is not in scope but it demonstrably belongs to Docusign,
you can report it to this program. Please also strictly adhere to the Out of Scope list and keep in mind that it is not an exhaustive list, and under no circumstances should any customer production environment be used for testing.
##Reporting Guidelines
- Include clear reproduction steps. You may send a video for clarity, but we need clear step-by-step written instructions. Also include a meaningful impact or attack scenario.
- Vulnerabilities exploited using similar payloads on the same path or source will be eligible for only one reward - subsequent reports of the same issue will be considered duplicates.
- Similar issues that use the same configuration for bypassing a particular control, which may be used on multiple related vulnerable endpoints or actions (User X can Create/Read/Update/Delete Resource Y). These issues should be grouped in one report.
- Access control bypasses occurring within the same account will be treated as low priority. Our accounts include an invite feature, so reports involving invited users performing malicious actions will also be considered low priority.
- Please provide the account ID and email address used during testing. If the vulnerability involves an envelope, please include the envelope ID as well.