Infisical

By Infisical, Inc. Vulnerability disclosure program on Self-hosted infisical.com

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No This disclosure program does not offer monetary rewards.
Response: Within 3 days Acknowledgement │ Within 3 business days
Safe harbor: Full If you make a good-faith effort to comply with this policy during your research, we will consider your research authorized, we will work with you to understand and resolve the issue quickly, and Infisical, Inc. and its affiliates will not pursue or support legal action against you in connection with
Hall of fame: Yes We are happy to credit you publicly in the advisory and release notes, unless you would prefer we did not.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

11 assets you may test, 7 excluded.

Out of scope (7)

Any Infisical instance you do not own or operate.
Archived and superseded repositories
Hostnames not listed above.
Infisical's internal infrastructure and cloud control plane.
Repositories that are not part of the product
Third-party services and platforms we use, which have their own disclosure programs.
Upstream forks we do not ship.

What the policy asks of you, and the bug types it won't reward, quoted from Infisical's policy. "We" in these lines means the program, not this site.

Test only within your own organization. Create your own account and confine testing to resources you created.
Never access another tenant's data. If you find a path that reaches it, stop immediately.
Do not run denial-of-service or volumetric tests , and do not test rate limiting, lockout or brute-force protection.
Automated scanning requires prior approval. Ask first.
Do not exfiltrate, persist or pivot. Retrieve the minimum needed to demonstrate impact.
Use synthetic data. Do not upload real credentials or personal data of any kind.
Report privately rather than publicly , and hold the issue until we have shipped a fix and agreed a disclosure date with you.
Please do not enumerate or scan subdomains of infisical.com .

Denial of service, resource exhaustion and rate-limiting weaknesses.
Self-XSS, and issues requiring a victim to paste attacker-supplied content
Missing security headers or cookie flags with no demonstrated impact
Clickjacking on pages with no sensitive state-changing action
Automated scanner output with no validated, reproducible impact
Best-practice or hardening suggestions with no exploit
Third-party dependency vulnerabilities without a working exploit in Infisical's context.
Social engineering, phishing and physical attacks
Reports based solely on outdated software versions
Findings that require an insecure non-default configuration of a self-hosted instance.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake