Intermedia

Vulnerability disclosure program on Self-hosted intermedia.com

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No Currently we are not able to provide any monetary rewards.
Safe harbor: Full Any activities conducted in good faith in a manner consistent with this Program will be considered authorized conduct, and we will not initiate legal action against you for such activities.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

21 assets you may test.

What the policy asks of you, and the bug types it won't reward, quoted from Intermedia's policy.

Test only with your own Intermedia accounts when investigating bugs, and do not interact with other accounts
Avoid privacy violations, degradation of user experience, disruption of production systems, and destruction or manipulation of data.
Do not utilize automated scanners, that generate significant volumes of traffic.
Only exploit security vulnerabilities you discovered to the extent necessary to confirm the vulnerability.
Provide detailed reports to Intermedia with reproducible steps.
Do not try to bypass physical security controls in any of Intermedia offices, perform spamming or social engineering attacks against Intermedia customers, partners, vendors, or employees

"Scanner output" or scanner-generated reports
Denial of Service attacks
Brute Force attacks
CSV Injection
Security issues in apps or services that are not operated by Intermedia (including third-party services and websites operating on Intermedia’s subdomains)
Vulnerabilities requiring physical access to the victim's unlocked device
Spam or Social Engineering techniques
Issues relating to Password Policy
Non-sensitive information disclosure (such as product version, path, etc.)
CSRF in actions that are non-significant (e.g., logout) or do not require authentication (or a session) to exploit
Framing and clickjacking vulnerabilities without a documented series of clicks that produce a real security impact
Self-XSS without demonstrating a real impact for users
Lack of security mechanism or inconsistency with best practices without demonstrating a real security impact (e.g., lack of security headers)
SSL/TLS misconfigurations (e.g., weak cipher-suites)
Vulnerabilities that only affect users of outdated or unpatched browsers
Insecure cookie settings for non-sensitive cookies
Bugs that do not pose any security risk

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake