Glia
By Glia Technologies, Inc. Bug bounty on Self-hosted glia.com
- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs, from $200.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
| High |
|
$2,500 |
| Medium |
|
$1,000 |
| Low |
|
$200 |
- Top reward
-
$5,000
Tier 0: Critical Severity Bugs $5000 and up
- Lowest reward
-
$200
Tier 3: Low Severity Bugs $200 and up
- Safe harbor
-
Full
Activities conducted in a manner consistent with this program will be considered authorized conduct and we will not initiate legal action for such activities.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 11 excluded.
Domains 4
- glia.com
- glia.eu
- salemove.com
- salemove.eu
Wildcard domains 4
- *.glia.com
- *.glia.eu
- *.salemove.com
- *.salemove.eu
Android apps 1
- Official Glia applications for iOS and Android
Products and areas 2
- Current versions of the official Glia Technologies applications for Windows, Mac, Linux, iOS, and Android
- Official Glia applications for Windows, Mac and Linux
Out of scope (11)
- community.glia.com
- glia.atlassian.net
- glia.testrtc.com
- go2.glia.com
- go.glia.com
- networktest.glia.com
- partners.glia.com
- status.glia.com
- www.cobrowsing.com
- www.glia.com
- *.digitalcustomerservicebook.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Glia's policy. "We" in these lines means the program, not this site.
While testing
-
Participants are required to report any vulnerabilities directly and exclusively to [email protected]
-
must not disclose them to the public or any third party prior to our resolution of the reported issues
-
Any access to, or handling of, user data should be minimized
-
Activities must be conducted in a manner that avoids any service disruption or degradation.
-
The introduction of malware or the use of automated tools or scripts for finding vulnerabilities is strictly prohibited.
-
The use of automated tools, scripts, or scanners is prohibited in this bug bounty program.
-
Submissions must be original and previously unreported.
-
Participants must comply with all applicable local, state, national, and international laws and regulations
Not accepted
-
Rate limiting on "Request for a demo" pages
-
Public code examples published by Glia as examples not be used in production workflows
-
Issues found through automated testing
-
URL findings from search engines and indexes
-
Vulnerabilities that are already known to Glia
-
"Scanner output" or scanner-generated reports
-
CSV Injection
-
Publicly-released bugs in internet software within 3 days of their disclosure
-
"Advisory" or "Informational" reports that do not include any Glia Technologies-specific testing or context
-
Vulnerabilities requiring physical access to the victim's unlocked device
-
Network Level DDoS/DoS attacks
-
Brute Force attacks
-
SPF, DKIM or DMARC issues
-
Content injection
-
Hyperlink injection in emails
-
IDN homograph attacks
-
RTL Ambiguity
-
Content Spoofing
-
Issues relating to Password Policy
-
Full-Path Disclosure on any property
-
Version number information disclosure
-
Clickjacking on pre-authenticated pages
-
CSRF-able actions that do not require authentication (or a session) to exploit
-
Enterprise Mobility Management
-
Security bugs in software related to an acquisition for a period of 90 days following any public announcement
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.