- Top reward
- $5,000
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- top reward, from $100.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 10 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$5,000
Any qualifying bug will be eligible for a bounty of a minimum of US$100 and a maximum of $5,000 .
- Lowest reward
-
$100
Any qualifying bug will be eligible for a bounty of a minimum of US$100 and a maximum of $5,000 .
- Response
-
Within 10 days
it may take up to 10 business days before you hear back from us.
- Safe harbor
-
Full
In return we promise to investigate reports promptly and not to take any legal action against you.
- Hall of fame
-
Yes
Our thanks to the following security researchers for their submissions:
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 3 excluded.
Domains 5
- app.fastmail.com
- fastmail.com
- fastmailfbl.com
- fastmailusercontent.com
- user.fm
Wildcard domains 1
- *.fastmail.com
Out of scope (3)
- fastmailusercontent.com
- user.fm
- www.fastmailfbl.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Fastmail's policy. "We" in these lines means the program, not this site.
While testing
-
You must give us reasonable time to fix any vulnerability you find before you make it public.
-
Use a test account (a free trial account is fine), or an account that you control.
-
Never interact with other accounts without the owner’s consent.
-
Report the bug to us first, and give us reasonable time to fix the issue before making it public.
-
Be the first person to report the issue to us.
-
All reports should begin with a clear summary of the problem, no more than one paragraph, stating what clear behaviour leads to what bad outcome, and include the minimal steps to reproduce the issue.
-
Please do not include an analysis of why the bug works and how to fix or, or what you think its severity is.
Not accepted
-
Email spoofing bugs do not qualify.
-
CSV Excel Macro Injection bugs via address book exporting do not qualify.
-
Denial of Service (DOS) and social engineering attacks do not qualify
-
Bugs that require exceedingly unlikely user interaction or are caused by insecurities in browser extensions do not qualify.
-
Brute force log in attempts.
-
any Cross-Site Scripting (XSS) attacks on these sites are not of interest to us
-
Bugs on sites associated with Fastmail but not run by Fastmail do not qualify.
-
Anything related to enumeration of usernames does not qualify.
-
Bugs related to unpatched, out of date or exceedingly rarely used browsers or other client software out of our control.
-
We are not interested in reports about “leakage” of the fact we run nginx, or the version number, or Perl module names or file paths.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.