Honeycomb
Vulnerability disclosure program on Self-hosted honeycomb.io
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Paid by non-cash payment method
- Proof of identity needed to get paid.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
Scope
2 assets you may test, 8 excluded.
Domains 2
- api.honeycomb.io
- ui.honeycomb.io
Out of scope (8)
- docs.honeycomb.io
- info.honeycomb.io
- www.honeycomb.io
- Issues already known to us or previously reported by others
- Issues we’ve determined to be of acceptable risk
- Out-of-date browsers and plugins
- Social engineering
- Vulnerabilities in third-party applications that don’t directly affect Honeycomb’s data or services
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Honeycomb's policy. "We" in these lines means the program, not this site.
While testing
-
Allow us reasonable time to investigate and mitigate an issue before disclosing or sharing it with others.
-
Not interact with other users or accounts without their explicit, informed consent.
-
Avoid all privacy violations and any disruption of service to other users and accounts.
-
Not exploit any security risk you discover, including through additional demonstrations of the same risk.
-
Comply with all applicable laws and regulations.
-
Submit reports that clearly demonstrate applicability to Honeycomb’s tools, systems, or infrastructure.
-
Provide your real name, proof of identity if requested, and a non-cash payment method.
-
Denial of service (DoS) attacks, or any action that generates excessive traffic
-
Testing rate limiting
-
Using automated tooling in a way that generates excessive traffic
Not accepted
-
Lack of password length restrictions
-
Demonstrating that a page can be iFramed without identifying a clickjackable link on that page
-
Self-XSS
-
Vulnerabilities that require privileged access to the victim’s device, such as a rooted phone
-
User existence or enumeration vulnerabilities
-
Password complexity requirements
-
Insecure cookie settings for non-sensitive cookies
-
Bugs that require highly unlikely user interaction to exploit
-
Reports from automated tools or scans without an accompanying demonstration of exploitability
-
Text-only injection in error pages
-
Automatic hyperlink construction by third-party email providers
-
Using email mutations ( + , . , etc.) to create multiple accounts from a single email address
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.