- Top reward
- $500
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $500
- top reward.
- Report as the policy says
- The policy page explains how.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$500
High and Medium vulnerabilities are the only ones entitled to a monetary reward (of up to US$500).
- Safe harbor
-
Full
Geckoboard pledges not to initiate legal action against researchers for penetrating or attempting to penetrate our systems as long as they adhere to this policy.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 3 excluded.
Domains 1
- app.geckoboard.com
Out of scope (3)
- community.geckoboard.com
- support.geckoboard.com
- www.geckoboard.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Geckoboard's policy. "We" in these lines means the program, not this site.
While testing
-
Performing actions that may negatively affect Geckoboard or its users (e.g. Spam, Brute Force, Denial of Service, etc).
-
Accessing, or attempting to access, data or information that does not belong to you.
-
Destroying or corrupting, or attempting to destroy or corrupt, data or information that does not belong to you.
-
Performing automated vulnerability scans.
-
Attempting non-technical attacks such as social engineering, phishing, or physical attacks against our employees, users, or infrastructure.
-
When signing up for an account to perform security testing, please use a real, reachable email address rather than a one‑off disposable address.
-
No attacks against Geckoboard's existing user base.
-
Do not create more than 2 accounts as part of your testing.
Not accepted
-
Duplicate and Declined submissions as well as any P5 (according to Bugcrowd's Taxonomy) submissions do not receive any rewards for this program.
-
False positives and/or very minor criticality that won't necessarily result in a change of code.
-
Vulnerabilities like insecure cookies, clickjacking or insufficient password complexity are generally of low criticality
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.