Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Invision Power Services, Inc.

Vulnerability disclosure program on HackerOne invisioncommunity.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
0
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Pays cash
No NOTE: Invision does not have a cash bounty reward program at this time.
Safe harbor
Partial We encourage safe and responsible security testing and reporting of security issues based on the following simple rules:

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

0 assets you may test.

HackerOne does not list the scope of this program publicly. Check its policy.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Invision Power Services, Inc. (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Do not attempt any testing that would result in a Denial-of-Service condition.
  • ALL security testing must be conducted in a non-production environment to minimize risk and impact to our customers.
  • Do not attempt to access, modify, or delete information that does not belong to you or your organization.
  • Do not run automated scans without checking with us first.
  • Do not test using social engineering techniques (such as phishing.)
  • Do not, in any way, attack or compromise our customers, end users or engage in the trade of stolen or leaked user credentials.
  • Do not disclose any report, or issues to the public or any third party without explicit permission from Invision Power Services, Inc.

Not accepted

  • Any issue that requires elevated (administrator) privileges to execute.
  • Descriptive error messages.
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages.
  • Clickjacking and issues only exploitable through clickjacking.
  • CSRF on forms that are available to guest users (e.g. the contact form).
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
  • Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
  • DNS issues.
  • Email issues including spoofing, SPF, DMARC and DKIM settings.
  • Password policies.
  • HTTP security headers.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 57 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Invision is fully committed to the security and protection of our customers’ data. We encourage safe and responsible security testing and reporting of security issues based on the following simple rules:

• Do not attempt any testing that would result in a Denial-of-Service condition. • ALL security testing must be conducted in a non-production environment to minimize risk and impact to our customers. Please contact security at invisionpower dot com to obtain a testing environment. • Do not attempt to access, modify, or delete information that does not belong to you or your organization. • Do not run automated scans without checking with us first. • Do not test using social engineering techniques (such as phishing.) • Do not, in any way, attack or compromise our customers, end users or engage in the trade of stolen or leaked user credentials. • Do not disclose any report, or issues to the public or any third party without explicit permission from Invision Power Services, Inc.

IMPORTANT: Please do not submit reports related to the following:

  • Any issue that requires elevated (administrator) privileges to execute.
  • Descriptive error messages.
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages.
  • Clickjacking and issues only exploitable through clickjacking.
  • CSRF on forms that are available to guest users (e.g. the contact form).
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
  • Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
  • DNS issues.
  • Email issues including spoofing, SPF, DMARC and DKIM settings.
  • Password policies.
  • HTTP security headers.

NOTE: Invision does not have a cash bounty reward program at this time. Your responsible reporting is, however, appreciated and kudos will be provided.

Please see www.invisioncommunity.com for full contact information and privacy policies.