- Top reward
- $101,010
- Top severity paid
- Not published
- Assets in scope
- 26
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $101,010
- top reward, from $100.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$101,010
Remote code execution (S0) │ Command injection, deserialization bugs, sandbox escapes │ $101,010 │ $101,010 │ $75,000 │ $10,000 │ $1,337 - $5,000
- Lowest reward
-
$100
Other valid security vulnerabilities, state-changing actions. Information Tier 2 leak or Moderate Actions . (C1c) │ Web : CSRF, XSLeaks , Clickjacking Mobile / Hardware : Information leak, privilege escalation │ $1,337 │ $1,337 │ $1,337 │ $100 │ $100
- Safe harbor
-
Partial
Of course, your testing must not violate any law, or disrupt or compromise any data that is not your own.
- Hall of fame
-
Yes
Monetary rewards aside, vulnerability reporters who work with us to resolve security bugs in our products will be credited on the Leaderboard .
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
26 assets you may test, 6 excluded.
Domains 14
- blogger.com
- deepmind.com
- google.com
- gousto.co.uk No bounty
- gousto.ie No bounty
- waymo.com
- wing.com
- www.google.com/url?q=http%3a%2f%2fgousto.co.uk&sa=d&usg=aovvaw2g-isg54f9h1jqrehhv16e&ust=1794058337912978 No bounty
- www.google.com/url?q=http%3a%2f%2fgousto.co.uk&sa=d&usg=aovvaw3lv2wa7q31fhxvvnwyo7tf&ust=1789202613399893 No bounty
- www.google.com/url?q=http%3a%2f%2fgousto.co.uk&sa=d&usg=aovvaw3y1q9dyeuhng2fqi89iynx&ust=1789081697025457 No bounty
- www.google.com/url?q=http%3a%2f%2fgousto.ie&sa=d&usg=aovvaw2mjnwl1yakdvczxafuqdsn&ust=1789081697025605 No bounty
- www.google.com/url?q=http%3a%2f%2fgousto.ie&sa=d&usg=aovvaw3f2ackw7ozir2o8tf3tg8j&ust=1794058337913102 No bounty
- www.google.com/url?q=http%3a%2f%2fgousto.ie&sa=d&usg=aovvaw3fq33v1jlodlo4fp8yaddr&ust=1789202613400034 No bounty
- youtube.com
Wildcard domains 8
- *.blogger.com
- *.deepmind.com
- *.google.com
- *.gousto.co.uk No bounty
- *.gousto.ie No bounty
- *.waymo.com
- *.wing.com
- *.youtube.com
Android apps 3
- Gousto Android app No bounty
- Gousto iOS and Android mobile applications No bounty
- Gousto iOS app No bounty
iOS apps 1
- Bugs in Google- and Waymo-developed apps published in the Apple App Store
Out of scope (6)
- Trustpilot
- Zendesk
- *.appspot.com
- *.bc.googleusercontent.com
- *.blogspot.com
- *.googleusercontent.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Google and Alphabet VRP's policy. "We" in these lines means the program, not this site.
While testing
-
When investigating a vulnerability, please, only ever target your own accounts.
-
Never attempt to access anyone else's data and do not engage in any activity that would be disruptive or damaging to your fellow users or to Google.
-
please do not attempt to carry out DoS attacks, leverage black hat SEO techniques, spam people, or do other similarly questionable things.
-
We also discourage the use of any vulnerability testing tools that automatically generate very significant volumes of traffic.
-
please do not try to sneak into Google offices, attempt phishing attacks against our employees, and so on.
-
your testing must not violate any law, or disrupt or compromise any data that is not your own.
Not accepted
-
Cross-site scripting vulnerabilities in “sandbox” domains
-
Execution of owner-supplied JavaScript in Blogger.
-
URL redirection
-
Legitimate content proxying and framing.
-
Bugs requiring exceedingly unlikely user interaction.
-
Logout cross-site request forgery
-
Flaws affecting the users of out-of-date browsers and plugins.
-
Presence of banner or version information.
-
Email spoofing on Gmail and Google Groups.
-
User enumeration.
-
Bypassing the limit of accounts that can be verified with a given SMS number.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.