- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Confirmed and fixed reports are rewarded with goodie bag.
- Response
-
Within 3 days
Every report receive first update in three working days (8x5 CET) via [email protected] .
- Safe harbor
-
Partial
Please note that we will not initiate a law enforcement investigation or any lawsuit against you for the content of the report.
- Hall of fame
-
Yes
ESET is a strong believer in, as well as a practitioner of, the responsible disclosure process and publicly credits security vulnerability reporters for their efforts if they do not wish to remain anonymous.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 30 excluded.
Products and areas 1
- any ESET product
Out of scope (30)
- Attacks requiring physical Access to user's device
- Clickjacking and issues only exploitable through clickjacking.
- CSRF on forms that are available to anonymous users (e.g. the contact form).
- CSRF on logout
- Denial of Service Attacks
- Descriptive error messages (e.g. Stack Traces, application or server errors)
- Disclosure of known public or non-sensitive files or directories, (e.g. robots.txt,crossdomain.xml or any other policy files, wildcard presence/misconfiguration in these).
- Findings derived primarily from social engineering (e.g. phishing, vishing, smishing) & other non-technical attacks
- Fingerprinting / banner disclosure on common/public services.
- Forgot Password page brute force and account lockout not enforced.
- Host-header injection Attacks
- HTTP 404 codes/pages or other HTTP non-200 codes/pages.
- Hypothetical issues that do not have any practical impact
- Informative severity & low severity issues
- Lack of Secure/HTTP Only/SameSite flags on non-sensitive Cookies.
- Mail configuration issues (SPF, DKIM, DMARC settings)
- Management issues with multiple concurrent active sessions
- Man in the middle attacks
- Missing Security headers (such as Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options)
- Nonstandard HTTP method enabled
- Open redirect that cannot be used to exfiltrate sensitive information (session cookies, OAuth tokens)
- Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
- Publicly accessible login panels without proof of exploitation
- Rate-limiting issues
- Reports from automated tools or scans
- Self-XSS and issues exploitable only through Self-XS
- Spamming
- Use of a known-vulnerable library without a description of an exploit specific to our implementation
- Username / email enumeration without any further impact
- Weak Captcha / Captcha Bypass
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Eset's policy. "We" in these lines means the program, not this site.
While testing
-
Never attempt to access personal information or sensitive data.
-
STOP your research or actions that include data or personal information immediately
-
DO NOT save, copy, disclose, transfer or do any activity related to data or personal information
-
ALERT us immediately and support us in the mitigation effort
-
We request the reporter to keep any communication regarding vulnerability confidential
-
Inform about any disclosure plans and coordinate with us
-
Must be written in the English language
Not accepted
-
Reports from automated tools or scans
-
Denial of Service Attacks
-
Man in the middle attacks
-
Attacks requiring physical Access to user's device
-
Hypothetical issues that do not have any practical impact
-
Publicly accessible login panels without proof of exploitation
-
Findings derived primarily from social engineering (e.g. phishing, vishing, smishing) & other non-technical attacks
-
Informative severity & low severity issues
-
Spamming
-
Clickjacking and issues only exploitable through clickjacking.
-
Fingerprinting / banner disclosure on common/public services.
-
Mail configuration issues (SPF, DKIM, DMARC settings)
-
Descriptive error messages (e.g. Stack Traces, application or server errors)
-
HTTP 404 codes/pages or other HTTP non-200 codes/pages.
-
Nonstandard HTTP method enabled
-
Missing Security headers (such as Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options)
-
Lack of Secure/HTTP Only/SameSite flags on non-sensitive Cookies.
-
Open redirect that cannot be used to exfiltrate sensitive information (session cookies, OAuth tokens)
-
Management issues with multiple concurrent active sessions
-
Host-header injection Attacks
-
Self-XSS and issues exploitable only through Self-XS
-
CSRF on forms that are available to anonymous users (e.g. the contact form).
-
CSRF on logout
-
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.