- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 0
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 1 days
Duo Security will provide an initial acknowledgement of your security report within 24 hours under normal circumstances once our PSIRT receives it.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
0 assets you may test.
Self-hosted does not list the scope of this program publicly. Check its policy.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Duo's policy. "We" in these lines means the program, not this site.
While testing
-
Do not exploit identified vulnerabilities in a manner that risks the confidentiality, integrity, and/or availability of any resources not explicitly owned by you during testing processes.
-
Do not use your findings to phish, spam, social engineer, or otherwise defraud any customers or Duo Security employees during the course of testing to gain more access.
-
Do not try to physically access Duo Security properties, attempt to social engineer employees, or otherwise try to discover risk beyond digital means against Duo Security.
-
Do not perform denial of services (DoS) or distributed denial of service (DDoS) attacks against any Duo Security resource to prove an impact for a suspected security issue.
-
If you are ever unclear on how far your testing should go, please reach out to the Duo Security PSIRT to coordinate testing with us.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.