- Top reward
- $500
- Top severity paid
- Critical
- Assets in scope
- 6
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $500
- for critical bugs, from $50.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$500 |
| High |
|
$200 |
| Medium |
|
$100 |
| Low |
|
$50 |
- Top reward
-
$500
Critical │ $500 │ Payment bypass, credit card data exposure, remote code execution, administrative authentication bypass, SQL injection affecting payment or customer data.
- Lowest reward
-
$50
Low │ $50 │ Minor information leakage, limited security misconfiguration, clickjacking on non-sensitive pages, email enumeration through contact forms.
- Safe harbor
-
Partial
Act in good faith. Ransom demands, abuse, or active exploitation will disqualify the report.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 5 excluded.
Domains 1
- foundation.xyz
Hardware and IoT 1
- Foundation hardware
Products and areas 4
- firmware
- services
- software
- websites
Out of scope (5)
- access to systems hosted by a 3rd party infrastructure provider, which has been deemed relevant to the hosting and securing of services at the domains listed above. the vulnerability must be addressable by our engineers. foundation reserves the right to make this determination at its sole discretion
- booking
- Development or staging systems
- docs subdomains
- third-party integrations
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Foundation's policy. "We" in these lines means the program, not this site.
While testing
-
Report privately. Keep users safe.
-
Use test payment methods only and avoid disrupting live transactions.
-
Act in good faith. Ransom demands, abuse, or active exploitation will disqualify the report.
-
Do not include sensitive customer data in your report. Describe how to reproduce the issue instead.
-
Keep communication professional and provide enough detail for Foundation to reproduce the issue.
-
Report privately first. Public disclosure should wait until Foundation confirms the issue is resolved.
Not accepted
-
SSL/TLS version reports, weak ciphers, or expired certificates without a direct exploit
-
Denial-of-service attacks, including denial-of-wallet, email or notification flooding, and rate-limit issues.
-
Self-XSS without a reasonable attack scenario
-
SPF, DKIM, or DMARC reports
-
Vulnerable software version disclosure without proof of vulnerability
-
Brute-force attacks and issues unrelated to the security or privacy of our users
-
Third-party API keys that are intended to ship inside client applications and whose only impact is third-party quota or billing use.
-
Missing security headers or cookie attributes (for example HttpOnly), and automated scanner output, where no working exploit is demonstrated.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2020-26304 | Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any fixes are available. | High 8.7 | 26 Oct 2024 |