Envato

By Envato Pty Ltd Vulnerability disclosure program on Self-hosted envato.com

Accepting reports

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No This program does not offer bounties or rewards, financial or otherwise.
Response: Within 3 days Swift resolution based on impact on our community, aiming for less than 72 hours after the report has been made.
Safe harbor: Partial Responsible disclosure , meaning that you give us a fair go in order to resolve the issue before the vulnerability is disclosed to the community.
Hall of fame: Yes In recognition of our appreciation, Helpful Hackers will be added to either the Envato Systems Honor Roll or the Envato Author Item Honor Roll , depending on the scope of the vulnerability.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

37 assets you may test, 3 excluded.

Out of scope (3)

all third party providers despite whether or not they are hosted on an Envato owned/operated subdomain
any service that isn't owned by Envato
Testing against third party systems/content (even under an Envato subdomain)

What the policy asks of you, and the bug types it won't reward, quoted from Envato's policy.

Test against any service that isn't owned by Envato.
Cause disruption to the availability of any Envato services.
Attempt to gain access to another user's data or information.
Impact other users with your testing.
Attempt non-technical attacks such as social engineering or physical attacks against employees or infrastructure.
Pivot your approach from one vulnerability to another in order to escalate your access.
Share sensitive information exposed during the course of finding a vulnerability.
Violate any laws.
If in doubt, get in touch first!

You are not the first person to identify the vulnerability
Testing against third party systems/content (even under an Envato subdomain)
Vulnerabilities that Envato determines to be an accepted risk.
misconfigured SPF records, missing CAA records, and the like
Vulnerabilities requiring exceedingly unlikely user interaction or steps to exploit.
Phishing attacks
Third party plugins or browser based scripts used to enhance or alter the Envato products
Presence of banner or version information
Denial of service attacks
General security advice without an identified vulnerability report

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake