JOIN
Vulnerability disclosure program on security.txt join.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
This is a non-award program and does not offer monetary rewards.
- Safe harbor
-
Full
Authorized in view of any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 13 excluded.
Domains 1
- join.com
Out of scope (13)
- Any access to data that requires the targeted user to be operating a rooted mobile device.
- Any physical attempts against our property or data centers.
- Attacks requiring physical access to a user’s device.
- Attacks that require an exploitation tool to overlay on top of our app (e.g., tapjacking).
- Logout cross-site request forgery.
- Missing cookie flags on non-sensitive cookies.
- Password, email, and account policies, such as email id verification, reset link expiration, and password complexity.
- Policies on presence/absence of SPF/DMARC records.
- Presence of autocomplete attribute on web forms.
- Social engineering of our employees or contractors.
- Vulnerabilities affecting users of outdated browsers or platforms.
- Vulnerabilities that require a potential victim to install non-standard software or otherwise take active steps to make themselves susceptible.
- XSS on any site other than join.com.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from JOIN's policy. "We" in these lines means the program, not this site.
While testing
-
Play by the rules. Adhere to this policy and any other relevant agreements, e.g., Terms of Service;
-
Report any vulnerability you’ve discovered promptly;
-
Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience;
-
Use only the Official Channels to discuss vulnerability information with us;
-
Handle the confidentiality of details of any discovered vulnerabilities according to the Coordinated Disclosure section below;
-
Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope;
-
If a vulnerability provides unintended access to user data, such as Personally Identifiable Information (PII), or proprietary information: Cease testing and submit a report immediately;
-
Only interact with accounts you own unless given explicit permission by the account holder;
-
Do not engage in extortion.
-
Never attempt non-technical attacks – such as social engineering, phishing, or physical attacks – against our employees, users, or infrastructure; and
Not accepted
-
Policies on presence/absence of SPF/DMARC records.
-
Password, email, and account policies, such as email id verification, reset link expiration, and password complexity.
-
Logout cross-site request forgery.
-
Attacks requiring physical access to a user’s device.
-
XSS on any site other than join.com.
-
Attacks that require an exploitation tool to overlay on top of our app (e.g., tapjacking).
-
Vulnerabilities that require a potential victim to install non-standard software or otherwise take active steps to make themselves susceptible.
-
Vulnerabilities affecting users of outdated browsers or platforms.
-
Social engineering of our employees or contractors.
-
Any physical attempts against our property or data centers.
-
Presence of autocomplete attribute on web forms.
-
Missing cookie flags on non-sensitive cookies.
-
Any access to data that requires the targeted user to be operating a rooted mobile device.
-
Use of a known-vulnerable library.
-
Missing best practices.
-
Insecure SSL/TLS ciphers.
-
Missing security headers, which do not directly lead to a vulnerability.
-
Lack of CSRF tokens, except when there is evidence of a sensitive user-action not protected by a token.
-
Host header injections.
-
Reports from automated tools or scans that haven’t been manually validated.
-
Presence of banner or version information, unless a vulnerable version.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.