- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 14
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- Paid by PayPal
- No identity requirement stated.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Additional hosting credit (or PayPal cash if you prefer and we agree)
- Response
-
Within 5 days
Send steps to reproduce via support. We aim to reply in 5 business days.
- Safe harbor
-
Full
We will not pursue legal action against anyone who follows these rules and reports in good faith, whether you’re reporting a bug or a vulnerability.
- Hall of fame
-
Yes
Hall of Fame entry (public page, name/handle + short description, anonymised on request)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 4 excluded.
Domains 7
- auth.iceline-hosting.com
- billing.iceline-hosting.com
- game.iceline-hosting.com
- iceline-hosting.com
- shield.iceline-hosting.com
- status.iceline-hosting.com
- vps.iceline-hosting.com
Products and areas 7
- Auth
- Iceline billing
- Iceline Game Panel
- Iceline main website
- Iceline Shield
- Iceline VPS panel
- Status page
Out of scope (4)
- Known dependency issues without a working exploit
- Low-impact issues with no demonstrable impact
- Social engineering, phishing, DoS/DDoS
- Third-party services we don’t control (e.g. CDN, infrastructure providers)
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Iceline Hosting's policy. "We" in these lines means the program, not this site.
While testing
-
Only demonstrate the issue to the extent needed; no unnecessary disruption, damage, or abuse of production.
-
Do not use real user data beyond what’s needed to show the bug or vulnerability.
-
Report in good faith. No extortion, threats, or harassment of staff about reward timing or tier decisions.
-
Give us reasonable time to fix before public disclosure.
-
Bulk automated scanning without per-finding manual validation and custom PoC is strongly discouraged and will be treated as low-effort.
-
Do not access, modify, or delete data that isn’t yours.
-
Do not perform denial-of-service or resource-exhaustion attacks.
Not accepted
-
Duplicates, out-of-scope, or low-effort reports get a thank-you but no reward.
-
Low-impact issues with no demonstrable impact
-
Known dependency issues without a working exploit
-
Social engineering, phishing, DoS/DDoS
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.