Internet Brands Public
By Internet Brands Bug bounty on Bugcrowd pulsepoint.com
- Top reward
- $2,000
- Top severity paid
- Critical
- Assets in scope
- 24
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $2,000
- for critical bugs, from $100.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Public disclosure allowed
- You may publish your report.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$2,000 |
| High |
|
$750 |
| Medium |
|
$100 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $2,000
Scope
24 assets you may test, 4 excluded.
Web 19
- https://accounts.webmd.com
- https://exchange.pulsepoint.com
- https://exchange.pulsepoint.com/AdminPortal/AdminDashBoard.aspx
- https://life.pulsepoint.com/Buyer/#/campaign
- https://life.pulsepoint.com/EngagementAudience/#/dashboard
- https://life.pulsepoint.com/MediaPlanner/#/dashboard/targetview
- https://login.medscape.com
- https://member.webmd.com
- https://pets.webmd.com
- https://portalv2.lh360.com
- https://powerpak.com
- https://profreg.medscape.com
- https://signal.pulsepoint.com/hcp365/#/dashboard/advertiser/6603/overview
- https://signal.pulsepoint.com/hcpexplorer/#/dashboard/eventsExplorer
- https://www.carsdirect.com
- https://www.demandforced3.com
- https://www.globalacademycme.com
- https://www.mdedge.com
- https://www.webmd.com
APIs 3
- https://lifeapi.pulsepoint.com
- https://openapi.pulsepoint.com
- https://openapitest.pulsepoint.com
Products and areas 2
- https://ibconnect.internetbrands.com
- https://www.internetbrands.com
Out of scope (4)
- https://checkout.webmd.com
- https://www.medjobnetwork.com
- https://www.powerpak.com/selectsurvey
- See PDF
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Internet Brands Public (via Bugcrowd)'s policy.
While testing
-
Any domain/property of Internet Brands not listed in the targets section may not be eligible for payout.
-
All targets are publicly accessible and do not require any additional steps to access.
-
If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.
-
You are expected, as always, to comply with all applicable laws.
Not accepted
-
Descriptive error messages (e.g. Stack Traces, application or server errors).
-
HTTP 404 codes/pages or other HTTP non-200 codes/pages.
-
Fingerprinting / banner disclosure on common/public services.
-
Disclosure of known public files or directories, (e.g. robots.txt).
-
Clickjacking and issues only exploitable through clickjacking.
-
CSRF on forms that are available to anonymous users (e.g. the contact form).
-
Logout Cross-Site Request Forgery (logout CSRF).
-
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
-
Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
-
Lack of Security Speedbump when leaving the site.
-
Weak Captcha / Captcha Bypass
-
Login or Forgot Password page brute force and account lockout not enforced.
-
OPTIONS HTTP method enabled
-
Username / email enumeration
-
Missing HTTP security headers
-
SSL Issues
-
Local File Inclusion
-
Dependency Confusion / Unclaimed Package Names
-
Cross-Site Scripting (XSS) findings are considered out of scope
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 minute ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://checkout.webmd.com (out of scope)
-
Scope added
https://www.medjobnetwork.com (out of scope)
-
Scope added
https://www.powerpak.com/selectsurvey/ (out of scope)
-
Scope added
https://life.pulsepoint.com/EngagementAudience/#/dashboard
-
Scope added
https://signal.pulsepoint.com/hcpexplorer/#/dashboard/eventsExplorer
-
Scope added
https://exchange.pulsepoint.com/AdminPortal/AdminDashBoard.aspx
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
No technology is perfect, and Internet Brands believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our applications. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Any domain/property of Internet Brands not listed in the targets section may not be eligible for payout. All domains/properties of Internet Brands listed as Out of Scope will not be rewarded. If you happen to identify a security vulnerability on a target that is not expressly identified either in scope or out of scope, but demonstrably belongs to Internet Brands, please report it here for consideration. However, be aware that there is no guarantee of rewards or points-based compensation for any properties not expressly identified as in scope. Shared Code Base Submissions on a domain where a fix would resolve subsequent and similar issues across different domains will be closed as a duplicate finding, and only the first valid submission will be eligible for reward. Similarly, if there is a single fix upstream which then deploys to multiple subdomains, then the first first submission will be eligible for reward and subsequent findings would be considered duplicates. Access All targets are publicly accessible and do not require any additional steps to access. Focus Areas Access to the Database Rights escalations Ability to manipulate data Excluded Vulnerability Types Descriptive error messages (e.g. Stack Traces, application or server errors). HTTP 404 codes/pages or other HTTP non-200 codes/pages. Fingerprinting / banner disclosure on common/public services. Disclosure of known public files or directories, (e.g. robots.txt). Clickjacking and issues only exploitable through clickjacking. CSRF on forms that are available to anonymous users (e.g. the contact form). Logout Cross-Site Request Forgery (logout CSRF). Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality. Lack of Secure/HTTPOnly flags on non-sensitive Cookies. Lack of Security Speedbump when leaving the site. Weak Captcha / Captcha Bypass Login or Forgot Password page brute force and account lockout not enforced. OPTIONS HTTP method enabled Username / email enumeration via Login Page error message via Forgot Password error message Missing HTTP security headers, specifically (https://www.owasp.org/index.php/List_of_useful_HTTP_headers), e.g. Strict-Transport-Security X-Frame-Options X-XSS-Protection X-Content-Type-Options Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP Content-Security-Policy-Report-Only SSL Issues, e.g. SSL Attacks such as BEAST, BREACH, Renegotiation attack SSL Forward secrecy not enabled SSL weak / insecure cipher suites Local File Inclusion Dependency Confusion / Unclaimed Package Names: Reports involving dependency confusion resulting from unclaimed npm packages or package names are out of scope. This includes additional occurrences involving different packages where the underlying root cause is the same organizational or supply-chain issue. Such reports may be considered duplicates of an existing finding or addressed through internal company-wide remediation processes. Cross-Site Scripting (XSS) findings are considered out of scope, as an enterprise-level remediation is being implemented to apply the HttpOnly and Secure flags on session/authentication cookies, mitigating the account takeover escalation path previously associated with these reports. SelectSurvey Application (powerpak.com/selectsurvey): Vulnerabilities identified within the SelectSurvey application, including its administrative interface, authentication mechanisms, survey functionality, user management, and associated data, are not eligible for submission or rewards under this program. -Demandforce Applications: All applications, websites, APIs, subdomains, and other assets associated with or operated by Demandforce are explicitly out of scope for this bug bounty program. Vulnerabilities identified in these assets are not eligible for submission or rewards. -PHP vulnerabilities related to this (https://www.php.net/archive/2026.php#2026-10-21-5) are currently out of scope as we are already working to remediate these across our organization. Please be aware that the domains/subdomains in the attached PDF document are expressly out of scope for this program. Out of Scope Domains.pdf Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.
In Scope (in scope)
Webmd is an online publisher of news and information pertaining to human health and well being. Lighthouse360+ provides customers with a robust solution to facilitate the relationship with patients, through communication and providing accessibility to self service. Demandforce provides customers with a robust solution to facilitate the relationship with patients, through communication and providing accessibility to self service. Powerpak provides educational programs for the broad spectrum of healthcare professionals. Medscape is the leading online global destination for physicians and healthcare professionals worldwide, offering the latest medical news and expert perspectives; essential point-of-care drug and disease information; and relevant professional education and CME. Global Academy for Medical Education LLC develops educational programs (live, web, and print) that are accredited through joint providership with ACCME-accredited providers.
Out of Scope (out of scope)
All targets listed in this PDF are considered out of scope in addition to the targets listed below.