Flexport VDP
By Flexport Vulnerability disclosure program on HackerOne flexport.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
This program does not provide bounty or monetary rewards for bug submissions.
- Response
-
Within 2 days
First Response | 2 days
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test.
Wildcard domains 2
- *.flexport.com Critical No bounty
- *.transmissionapp.com Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Flexport VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please DO NOT sign up or create any test accounts on any application which allows self registration.
-
Please use your own account for testing or research purposes.
-
Do not attempt to gain access to another user’s account or confidential information.
-
Testing is only authorized on the targets listed as In-Scope.
-
If you believe you've identified a vulnerability on a system outside the scope, please reach out to [email protected] before submitting.
Not accepted
-
Any vulnerability which requires self-registration
-
Credential re-usage from public dumps.
-
Vulnerabilities whose primary security impact is focused on Phishing.
-
UUID enumeration of any kind.
-
Account oracles
-
Open redirects.
-
Reports that state that software is out of date/vulnerable without a proof-of-concept.
-
Reports that affect only outdated user agents or app versions
-
Stack traces, path disclosure, and directory listings.
-
Best practice concerns.
-
Highly speculative reports about theoretical damage
-
Vulnerabilities that cannot be used to exploit other users or Flexport
-
Vulnerabilities as reported by automated tools without additional analysis as to how they're an issue.
-
Reports from automated web vulnerability scanners (Tenable, Qualys, etc.) that have not been validated.
-
Distributed denial of service attacks (DDOS).
-
Physical or social engineering attempts (this includes phishing attacks against Flexport employees).
-
Content injection issues.
-
Cross-site Request Forgery (CSRF) with minimal security implications (Logout CSRF, etc.)
-
Missing cookie flags on non-authentication cookies.
-
Issues that require physical access to a victim’s computer/device.
-
SSL/TLS scan reports (this means output from sites such as SSL Labs).
-
Banner grabbing issues (figuring out what web server we use, etc.).
-
Open ports without an accompanying proof-of-concept demonstrating vulnerability.
-
Entering the Flexport offices as a potential vendor, interviewee, or family/friend overhearing conversations and then attempting to extort
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
#Program Overview We appreciate your efforts and hard work in making the internet (and Flexport) more secure, and look forward to working with the researcher community to create a meaningful and successful vulnerability disclosure program. Good luck and happy hunting!
Response Targets
Flexport will make a best effort to meet the following SLAs for hackers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | 2 days |
| Time to Triage | 5 days |
| Time to Resolution | Depends on severity and complexity |
Objective
To state explicitly the submissions and report types that will be out of scope and not considered for rewards. This disclosure program is limited to security vulnerabilities in web applications owned by Flexport. This program does not provide bounty or monetary rewards for bug submissions.
Ratings/Rewards:
It is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Testing is only authorized on the targets listed as In-Scope. Any domain/property of Flexport not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to [email protected] before submitting.
##Safe Harbor:
When conducting vulnerability research according to this policy, we consider this research to be:
- Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
- Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
- Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
- Lawful, helpful to the overall security of the Internet, and conducted in good faith.
- You are expected, as always, to comply with all applicable laws.
If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.
##In Scope Targets
- *.flexport.com
- *.transmissionapp.com
- *.deliverr.com
- *.convoy.com
Please DO NOT sign up or create any test accounts on any application which allows self registration. Any vulnerability which requires a user account would be considered out of scope.
###Access: All targets are publicly accessible. Please use your own account for testing or research purposes. Do not attempt to gain access to another user’s account or confidential information.
#Out of Scope
- Any vulnerability which requires self-registration (for example: https://developers.flexport.com/s/forums). This is to avoid spamming of our public forums.
- Not applicable -- non reproducible security vulnerability or explicitly out-of-scope per our guidelines.
- Credential re-usage from public dumps.
- Vulnerabilities whose primary security impact is focused on Phishing.
- UUID enumeration of any kind.
- Account oracles -- the ability to submit a phone number, email, UUID and receive back a message indicating an Flexport account exists.
- Open redirects. 99% of open redirects have low security impact. For the rare cases where the impact is higher, e.g., stealing oauth tokens, we do still want to hear about them.
- Reports that state that software is out of date/vulnerable without a proof-of-concept.
- Reports that affect only outdated user agents or app versions -- we only consider exploits in the latest browser versions for Safari, FireFox, Chrome, Edge, IE and the versions of our application that are currently in the app stores.
- Stack traces, path disclosure, and directory listings.
- Best practice concerns.
- Highly speculative reports about theoretical damage -- please always provide a proof-of-concept.
- Vulnerabilities that cannot be used to exploit other users or Flexport -- e.g. self-xss or having a user paste JavaScript into the browser console.
- Vulnerabilities as reported by automated tools without additional analysis as to how they're an issue.
- Reports from automated web vulnerability scanners (Tenable, Qualys, etc.) that have not been validated.
- Distributed denial of service attacks (DDOS).
- Physical or social engineering attempts (this includes phishing attacks against Flexport employees).
- Content injection issues.
- Cross-site Request Forgery (CSRF) with minimal security implications (Logout CSRF, etc.)
- Missing cookie flags on non-authentication cookies.
- Issues that require physical access to a victim’s computer/device.
- SSL/TLS scan reports (this means output from sites such as SSL Labs).
- Banner grabbing issues (figuring out what web server we use, etc.).
- Open ports without an accompanying proof-of-concept demonstrating vulnerability.
- Entering the Flexport offices as a potential vendor, interviewee, or family/friend overhearing conversations and then attempting to extort