InfinityFree
Bug bounty on security.txt infinityfree.com
- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
In case of valid vulnerabilities, we are happy to pay out an appropriate bounty.
- Safe harbor
-
Full
InfinityFree considers ethical hacking activities that follow these rules to be “authorized” conduct under criminal law. We will not pursue legal action as long as you comply by these rules, or in case of any accidental, good faith violations.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 5 excluded.
Domains 3
- dash.infinityfree.com
- forum.infinityfree.com
- infinityfree.com
Out of scope (5)
- cpanel.epizy.com
- cpanel.infinityfree.com
- cpanel.rf.gd
- filemanager.ai
- scriptinstall.rocks
Rules
What the policy asks of you, and the bug types it won't reward, quoted from InfinityFree's policy. "We" in these lines means the program, not this site.
While testing
-
Please clean up remnants of your testing and do not interfere with the normal operation of the site.
-
Please do NOT use automatic scanners. We cannot accept any submissions found by using automatic scanners.
-
Do not exploit the identified leak: only collect the information necessary to demonstrate its existence.
-
Do not change or delete any data or system settings.
-
Handle any found data in a responsible manner: if you can demonstrate that there is a security problem with a small portion, do not go any further.
-
Please do NOT publish/discuss bugs before they are fixed.
-
DoS/DDoS attacks or brute force attacks : These attacks are strictly prohibited and will be reported to relevant law enforcement agencies.
-
We need time to patch our systems just like everyone else - please give us 2 weeks before reporting these types of issues.
Not accepted
-
Self-XSS that cannot be used to exploit other users
-
Verbose messages/files/directory listings without disclosing any sensitive information
-
CORS misconfiguration on non sensitive endpoints
-
Missing cookie flags on non sensitive cookies
-
Missing security headers which do not present an immediate security vulnerability
-
Cross-site Request Forgery with no or low impact
-
Presence of autocomplete attribute on web forms
-
Reverse tabnabbing
-
Bypassing rate-limits or the non-existence of rate-limits
-
Best practices violations (password complexity, expiration, re-use, etc.)
-
Clickjacking on pages without sensitive actions
-
CSV Injection
-
Host Header Injection
-
Sessions not being invalidated (logout, enabling 2FA, etc.)
-
Hyperlink injection/takeovers
-
Cross-domain referer leakage
-
Anything related to email spoofing, SPF, DMARC or DKIM
-
Content injection
-
Username / email enumeration
-
E-mail bombing
-
HTTP Request smuggling without any proven impact
-
Homograph attacks
-
XMLRPC enabled
-
Banner grabbing / Version disclosure
-
Open ports without an accompanying proof-of-concept demonstrating vulnerability
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.