Jumpseller
Bug bounty on security.txt jumpseller.com
- Top reward
- $2,500
- Top severity paid
- Critical
- Assets in scope
- 7
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $2,500
- for critical bugs, from $25.
- Report by email
- https://jumpseller.com/security/report-vulnerability/
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$2,500 from $1,500 |
| High |
|
$500 from $300 |
| Medium |
|
$150 from $60 |
| Low |
|
$50 from $25 |
- Top reward
-
$2,500
Critical — $1,500 to $2,500 USD
- Lowest reward
-
$25
Low — $25 to $50 USD
- Response
-
Within 3 days
Acknowledge your report within 3 business days.
- Safe harbor
-
Full
If you follow this policy in good faith, we will not pursue or support legal action against you for your research, and we will treat it as authorised under applicable computer misuse law.
- Hall of fame
-
Yes
Credit you publicly when the fix is out, if you want to be credited.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
7 assets you may test, 6 excluded.
Domains 2
- jumpseller.com
- jumpseller.com and our regional domains
APIs 1
- api.jumpseller.com
Web 1
- <store_code>.jumpseller.com/admin
Wildcard domains 1
- <store_code>.jumpseller.com
Products and areas 2
- Apps and themes developed by Jumpseller
- our OAuth2 server
Out of scope (6)
- Anything that requires a compromised device or a malicious app already installed on it, and self-XSS.
- Content, theme code, apps or configuration authored by a merchant on their own store.
- Denial of service, rate limiting, spamming, and volumetric testing.
- Raw scanner output, or missing hardening headers, without a demonstrated attack.
- Social engineering of our staff, merchants or customers, and physical attempts against Jumpseller property.
- Third-party services we integrate with.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Jumpseller's policy. "We" in these lines means the program, not this site.
While testing
-
Stop as soon as you have confirmed a vulnerability. Do not pivot, escalate, or access more data than you need to demonstrate it.
-
Never access, modify, export or retain merchant or customer data.
-
Do not disrupt our services, and do not run automated scans at a rate that affects other users.
-
Give us reasonable time to fix the issue before disclosing it.
-
Test against a store you created yourself.
-
Never test against a store you do not own, whether it is on *.jumpseller.com or on a merchant's own domain.
Not accepted
-
CSRF tokens are not enabled on some admin controllers.
-
XSS originating from a store's own admin panel.
-
Email addresses are not validated everywhere, deliberately, for business reasons.
-
Click-jacking on jumpseller.com
-
Raw scanner output, or missing hardening headers, without a demonstrated attack.
-
self-XSS
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.