Karbon

Vulnerability disclosure program on Self-hosted karbonhq.com

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No Please note at this time Karbon does not have a bug bounty program.
Response: Within 3 days If you share contact information, we will acknowledge receipt of your report within 3 business days .
Safe harbor: Full If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and Karbon will not recommend or pursue legal action related to your research.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

9 assets you may test, 4 excluded.

Out of scope (4)

Any service not expressly listed above, such as any connected services
Attacking registration, contact and appointment forms hosted on our marketing website karbonhq.com e.g. blind XSS attacks.
Systems or issues that relate to Third-Party technology used by Karbon e.g. Google Workspace
vulnerabilities found in systems from our vendors

What the policy asks of you, and the bug types it won't reward, quoted from Karbon's policy. "We" in these lines means the program, not this site.

Notify us as soon as possible after you discover a real or potential security issue with clear steps to reproduce the issue and ideally screenshots or a video.
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
Only use exploits to the extent necessary to confirm a vulnerability’s presence.
Provide us a reasonable amount of time to resolve the issue before you disclose it publicly.
Do not submit a high volume of low-quality reports.
When testing the Karbon application please add "- Ext Sec Test" to your Karbon tenant name so we can easily identify tenants created for security testing purposes.
Network denial of service (DoS or DDoS) tests or other tests that impair access to or damage a system or data
Brute force scanning and enumeration of endpoints and sub-domains using (but not limited to tools) such as gobuster and ffuf
Phishing or social engineering of Karbon employees, users or clients

Infrastructure related enhancements: SPF, DKIM, DMARC, MTA-STS, DNSSEC, CAA and similar
Missing web security headers
Potential tab-nabbing
Minor infrastructure detail disclosure without impact
Verbose error messages (unless containing sensitive data)
Out of data client libraries unless demonstrable impact
Tokens not expiring immediately
Front-end analytic related endpoints exposed or associated API keys
User enumeration
Issues only present in old browsers/old plugins/end-of-life software browsers

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 6 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake