- Top reward
- $5,000
- Top severity paid
- Not published
- Assets in scope
- 23
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- top reward, from $10.
- Report by email
- [email protected]
- Replies within 3 days
- As the policy promises.
- Payment
- Proof of identity needed to get paid.
Rewards
What the company's own policy page says it pays.
The old policy link stopped working, so we followed the company's security.txt to the current policy.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$5,000
Access to highly sensitive user information or account takeover without user interaction ($1,000 - $5,000)
- Lowest reward
-
$10
DDoS ($10 - $100)
- Response
-
Within 3 days
If you have not received a response within 72 hours of submitting a report, please contact [email protected] to confirm that your submission was received.
- Hall of fame
-
Yes
Valid findings may be fixed and publicly acknowledged at our fixed vulnerabilities page
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
23 assets you may test, 14 excluded.
Source code 9
- https://github.com/FlowCrypt/flowcrypt-android
- https://github.com/FlowCrypt/flowcrypt-attester-ts
- https://github.com/FlowCrypt/flowcrypt-backend
- https://github.com/FlowCrypt/flowcrypt-browser
- https://github.com/FlowCrypt/flowcrypt-ios
- https://github.com/FlowCrypt/flowcrypt-web
- https://github.com/pgpainless/pgpainless
- PGPainless Library
- Source Code
Android apps 3
- Android App
- flowcrypt-android
- flowcrypt-ios
Web 3
- flowcrypt.com/account
- flowcrypt.com/attester
- flowcrypt.com/me/[user]
APIs 2
- Backend API
- flowcrypt.com/api
Domains 1
- flowcrypt.com
iOS apps 1
- iOS App
Products and areas 4
- Browser Extension
- Encrypted Contact Page
- FlowCrypt Account Settings
- FlowCrypt Attester
Out of scope (14)
- Account enumeration.
- A DoS attack against public FlowCrypt services.
- Blind SSRF specifically for WKD requests from client apps that only cause IP/user agent exfiltration.
- DNSSEC-related issues.
- Phishing and pure social engineering attacks are out of scope
- Physical‑access attacks on a victim’s computer or device, man‑in‑the‑middle exploits, or compromised user accounts.
- Public IP disclosure.
- Reporting on email-related security issues, such as SPF, DNSSEC, DKIM, and DMARC.
- Snapshot/Pasteboard/Clipboard data leakage.
- StrandHogg 1.0 and 2.0 vulnerabilities are out of scope for the Android app.
- https://github.com/FlowCrypt/enterprise-server
- https://github.com/FlowCrypt/flowcrypt-deploy
- https://github.com/FlowCrypt/flowcrypt-key-manager
- https://github.com/FlowCrypt/flowcrypt-security
Rules
What the policy asks of you, and the bug types it won't reward, quoted from FlowCrypt a.s.'s policy. "We" in these lines means the program, not this site.
While testing
-
Each report submission must include one video demonstrating proof of concept of the vulnerability.
-
Altering, accessing, or obtaining private information from live accounts you don’t control is disallowed.
-
These vulnerabilities are in scope, but they should only be performed against test accounts you control.
-
please contact us before implementing a Proof-of-Concept for any DoS that involves server-side software or might impact accounts that you do not control.
Not accepted
-
AI-generated report submissions that are unrealistic or lack manual verification will not be accepted.
-
The ability of users to take manual screenshots on the mobile application isn’t considered a vulnerability.
-
Users can delete their account and recreate it to begin another free trial ad infinitum.
-
The Encrypted Contact Page lets senders put any Reply-To address they wish.
-
Unrestricted file upload on the Encrypted Contact Page or Secure Compose.
-
Mobile SSL Pinning.
-
Reusable auth_id_token session cookie after logout on FlowCrypt Account settings.
-
Submitting spam reports will not be tolerated
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.