Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

ECOVACS Home Robots Co., Ltd.

Vulnerability disclosure program on security.txt ecovacs.com

Accepting reports security.txt
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
3
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Scope

3 assets you may test, 1 excluded.

Domains 2

  • ecovacs.cn
  • ecovacs.com

Products and areas 1

  • ECOVACS products and services
Out of scope (1)
  • Vulnerabilities unrelated to ECOVACS

Rules

What the policy asks of you, and the bug types it won't reward, quoted from ECOVACS Home Robots Co., Ltd.'s policy.

While testing

  • Without the explicit authorization of ECOVACS, discussing or disclosing relevant vulnerability details in any public venue or platform is prohibited.
  • For identical vulnerabilities submitted by multiple researchers or by the same researcher repeatedly, only the first valid submission will be recognized.
  • Scan results from third-party tools or online platforms cannot be directly taken as vulnerability proof.
  • Submissions that fail to provide specific vulnerability description, verification method and harm, or merely report the use of HTTP instead of HTTPS, will not be recognized as security issues.

Not accepted

  • product function defects, page display issues, non-reproducible error messages that do not disclose sensitive information
  • directory traversal without sensitive information, 401 phishing, non-exploitable encoding flaws, non-hazardous Self-XSS
  • CSRF without sensitive operations, meaningless abnormal information disclosure / front-end source code leakage
  • scanner results without proven harm, non-sensitive JSON hijacking, bundled files containing only JS and IMG
  • regular logcat information, plaintext username transmission, iframe phishing, failure to implement SSL/TLS best security practices
  • pure guesswork, test pages without sensitive information, SSRF that cannot obtain internal server information and only accesses DNS log
  • theoretically feasible but non-exploitable vulnerabilities, use of vulnerable components without direct exploitation
  • failure to adopt optimal security configurations
  • password policy issues, unsuccessful account password brute-force attempts, PDF XSS in static files, Baidu Maps AK leakage
  • non-impacting actuator endpoints such as Prometheus, concurrent likes, limited SMS bombing
  • username and phone number enumeration, zombie user registration, invalid image CAPTCHA, credential stuffing
  • password brute-force attacks, email/SMS bombing
  • Device firmware is not effectively encrypted, but no more severe vulnerabilities can be reversed from the firmware.
  • Device debug interface is enabled but no shell can be obtained.
  • Firmware is downloaded via HTTP, but the firmware includes integrity and source authentication.
  • Local DDoS attacks against the user’s own device.
  • End-of-life (EOL) devices (except for Critical vulnerabilities).
  • APP lacks code obfuscation, APK can be repackaged, APP contains hard-coded or recoverable non-critical information keys, APP lacks binary protection controls.
  • Attacks that require physical access and breach of device hardware integrity.
  • Attacks launched in developer mode (high-impact issues such as privilege escalation may be evaluated separately).
  • Open-source and third-party vulnerabilities that also affect other industry devices (high-impact vulnerabilities to the device may be evaluated separately).

Summarised with AI from the company's policy, and checked word for word against it. Read the original

Changes

Tracked since 12 Nov 2026. Last checked 3 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.