- Top reward
- $100
- Top severity paid
- Not published
- Assets in scope
- 4
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $100
- top reward, from $100.
- Report by email
- [email protected]
- Replies within 14 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$100
If they meet our criteria we will pay $100 USD per unique bug reported.
- Lowest reward
-
$100
We pay $100 USD per accepted bug.
- Response
-
Within 14 days
Once we receive the bug reports we will take up to 14 business days to review and reply to them.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 1 excluded.
Domains 4
- app.hubstaff.com
- hubstaff.com
- hubstafftalent.net
- tasks.hubstaff.com
Out of scope (1)
- 3rd-party systems
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Hubstaff's policy. "We" in these lines means the program, not this site.
While testing
-
When submitting a bug report, please email [email protected] and include clear evidence of the issue .
-
Reports must include detailed steps to reproduce the vulnerability, along with a video demonstrating the issue end-to-end .
-
Submissions without sufficient evidence or reproducible steps may not be accepted.
Not accepted
-
Descriptive error messages (e.g. Stack traces, application or server errors)
-
HTTP 404 codes/pages or other HTTP non-200 codes/pages
-
Banner disclosure on common/public services
-
Disclosure of known public files or directories, (e.g. robots.txt)
-
Clickjacking and issues only exploitable through clickjacking
-
Self-XSS and issues exploitable only through Self-XSS
-
CSRF on forms that are available to anonymous users (e.g. the contact form)
-
Tab nabbing
-
Stripping EXIF data from uploaded images
-
Logout Cross-Site Request Forgery (logout CSRF)
-
Presence of application or web browser "autocomplete" or "save password"
-
Issues that require physical access to the device to carry out the exploit
-
DMARC configuration not in quarantine or reject mode
-
WordPress XMLRPC or Rest API scripts not deleted (they are disabled as much as our host will allow)
-
Reports relating to the password policy
-
Any duplicate bug reports that we have previously received will be excluded.
-
Any bug reports for which the fix is not feasible will be excluded.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-53937 | Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application startup. | High 8.5 | 18 Dec 2025 |