Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Flock Safety

Vulnerability disclosure program on Self-hosted flocksafety.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
10
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 5 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No Flock does not run a paid bug bounty program, and we do not offer monetary rewards for vulnerability reports.
Response
Within 5 days We confirm receipt within 5 business days.
Safe harbor
Full We will consider your research authorized, and we will not initiate or support legal action against you for it.
Hall of fame
Yes We are glad to credit researchers who report valid vulnerabilities, in the advisory and in the CVE record.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

10 assets you may test, 4 excluded.

Android apps 1

  • Flock mobile applications

Desktop and binaries 1

  • embedded software and firmware

Domains 1

  • flocksafety.com

Hardware and IoT 1

  • hardware devices

Web 1

  • Flock web applications

Products and areas 5

  • all Flock products and services
  • cloud services
  • Flock cloud services
  • Flock hardware devices, embedded software and firmware
  • mobile and web applications
Out of scope (4)
  • store.flocksafety.com
  • cameras, devices, accounts, or systems belonging to any Flock customer or agency
  • Flock facilities, personnel, or field-deployed devices
  • live customer deployments

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Flock Safety's policy. "We" in these lines means the program, not this site.

While testing

  • Do not access, test, or interact with cameras, devices, accounts, or systems belonging to any Flock customer or agency.
  • Do not submit unmodified scanner or model output as a report body.
  • Do not paste our source code, credentials, customer data, or any data obtained during testing into third-party AI services.
  • Do not degrade our service or our customers' service while testing.
  • Give us time to fix the issue before you disclose it publicly.

Not accepted

  • Findings with no demonstrated security impact, or automated scanner output with no supporting analysis
  • Known-vulnerable third-party libraries reported without a working proof of concept
  • Software version disclosure, banner identification, and descriptive error messages or headers, including stack traces and server errors
  • Content spoofing or text injection where you cannot modify HTML or CSS or otherwise show an attack vector
  • CSV injection without a demonstrated vulnerability
  • Open redirects, unless you can show an additional security impact
  • Clickjacking and tabnabbing on pages with no sensitive actions
  • Cross-site request forgery on unauthenticated forms, or forms with no sensitive action
  • Missing or suboptimal SSL, TLS, or HSTS configuration, including missing CAA records
  • Missing or incomplete Content Security Policy
  • Missing HttpOnly or Secure flags on cookies
  • Missing or misconfigured email authentication records, including SPF, DKIM, and DMARC
  • Rate limiting or brute force on endpoints that are not authentication endpoints
  • DNS misconfigurations, including dangling DNS entries and claimed subdomain takeovers, without proof of an actual takeover
  • Takeover of generic domain verification records
  • Issues that only affect users on outdated or unpatched browsers, meaning more than two stable versions behind the current stable release
  • Publicly disclosed vulnerabilities in third-party components patched within the last 7 days, which we may already be tracking

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.