Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Klaviyo Managed Bug Bounty

By Klaviyo Bug bounty on Bugcrowd klaviyo.com

Accepting reports Full safe harbor
Go to program
Top reward
$3,500
Top severity paid
Critical
Assets in scope
92
Public CVEs
2
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $3,500
for critical bugs, from $150.
Report on Bugcrowd
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 3 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What Bugcrowd lists as the payout for each severity.

Severity Reward
Critical $3,500 from $2,100
High $1,750 from $1,000
Medium $600 from $450
Low $200 from $150
Informational $50
Response
Within 3 days Time to first response: 3
Safe harbor
Full Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), with no legal action for accidental good-faith violations

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Earlier reward tables (1)
  • 11 Nov 2026 to 11 Nov 2026: Critical up to $3,500

Scope

92 assets you may test.

Networks 41

  • 12.109.179.242/32
  • 12.109.179.243/32
  • 12.109.179.244/32
  • 12.162.226.194/32
  • 12.162.226.195/32
  • 12.162.226.196/32
  • 12.162.226.197/32
  • 12.162.226.198/32
  • 13.236.111.63/32
  • 14.200.250.155/32
  • 14.200.250.156/32
  • 144.121.5.144/29
  • 144.121.57.208/29
  • 18.133.56.249/32
  • 18.144.159.16/32
  • 18.168.137.251/32
  • 18.168.212.94/32
  • 18.168.232.92/32
  • 23.20.21.255/32
  • 3.105.93.78/32
  • 3.208.141.108/32
  • 3.222.226.200/32
  • 38.140.97.154/32
  • 38.140.97.155/32
  • 38.140.97.156/32
  • 44.197.10.144/32
  • 46.31.171.122/32
  • 46.31.171.123/32
  • 50.150.76.0/30
  • 50.18.34.165/32
  • 50.228.235.80/29
  • 52.8.118.227/32
  • 54.160.106.200/32
  • 64.125.104.194/32
  • 64.125.104.195/32
  • 64.125.104.196/32
  • 64.125.104.197/32
  • 64.125.104.198/32
  • 64.71.19.71/32
  • 82.144.244.58/32
  • 82.144.244.59/32

Web 7

  • https://*.clovesoftware.com
  • https://*.clovesoftware-dev.com
  • https://klaviyo.com/*
  • https://*.klaviyo-dev.com/*
  • https://*.klaviyomsv.com/*
  • https://*.myklpages.com/*
  • https://*.services.klaviyo.com

APIs 1

  • https://a.klaviyo.com/api/*

Products and areas 43

  • http://mcp.klaviyo.com/
  • Klaviyo AWS/S3 Assets
  • Klaviyo Infrascucture - 50.150.76.0/30
  • Klaviyo Infrastructure - 12.109.179.242/32
  • Klaviyo Infrastructure - 12.109.179.243/32
  • Klaviyo Infrastructure - 12.109.179.244/32
  • Klaviyo Infrastructure - 12.162.226.194/32
  • Klaviyo Infrastructure - 12.162.226.195/32
  • Klaviyo Infrastructure - 12.162.226.196/32
  • Klaviyo Infrastructure - 12.162.226.197/32
  • Klaviyo Infrastructure - 12.162.226.198/32
  • Klaviyo Infrastructure - 13.236.111.63/32
  • Klaviyo Infrastructure - 14.200.250.155/32
  • Klaviyo Infrastructure - 14.200.250.156/32
  • Klaviyo Infrastructure - 144.121.5.144/29
  • Klaviyo Infrastructure - 144.121.57.208/29
  • Klaviyo Infrastructure - 18.133.56.249/32
  • Klaviyo Infrastructure - 18.144.159.16/32
  • Klaviyo Infrastructure - 18.168.137.251/32
  • Klaviyo Infrastructure - 18.168.212.94/32
  • Klaviyo Infrastructure - 18.168.232.92/32
  • Klaviyo Infrastructure - 23.20.21.255/32
  • Klaviyo Infrastructure - 3.105.93.78/32
  • Klaviyo Infrastructure - 3.208.141.108/32
  • Klaviyo Infrastructure - 3.222.226.200/32
  • Klaviyo Infrastructure - 38.140.97.154/32
  • Klaviyo Infrastructure - 38.140.97.155/32
  • Klaviyo Infrastructure - 38.140.97.156/32
  • Klaviyo Infrastructure - 44.197.10.144/32
  • Klaviyo Infrastructure - 46.31.171.122/32
  • Klaviyo Infrastructure - 46.31.171.123/32
  • Klaviyo Infrastructure - 50.18.34.165/32
  • Klaviyo Infrastructure - 50.228.235.80/29
  • Klaviyo Infrastructure - 52.8.118.227/32
  • Klaviyo Infrastructure - 54.160.106.200/32
  • Klaviyo Infrastructure - 64.125.104.194/32
  • Klaviyo Infrastructure - 64.125.104.195/32
  • Klaviyo Infrastructure - 64.125.104.196/32
  • Klaviyo Infrastructure - 64.125.104.197/32
  • Klaviyo Infrastructure - 64.125.104.198/32
  • Klaviyo Infrastructure - 64.71.19.71/32
  • Klaviyo Infrastructure - 82.144.244.58/32
  • Klaviyo Infrastructure - 82.144.244.59/32

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Klaviyo Managed Bug Bounty (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.

While testing

  • Testing is only authorized on the targets listed as in scope.
  • Provide detailed reports with reproducible steps; otherwise the report is not eligible for a reward.
  • Use your Bugcrowd email address when signing up to the Klaviyo platform.
  • Submit one vulnerability per report unless chaining is required.
  • Social engineering (phishing, vishing, smishing) is prohibited; reliant findings rewarded only at our discretion.
  • Make a good-faith effort to avoid privacy violations, data destruction, and service degradation.
  • Attacking customer accounts is strictly prohibited .
  • Enumerating the /api/v1/people path is not covered by our safe harbor, single tests on the base path with no page argument or "page=1" are covered by safe harbor.
  • Keep all information on Bugcrowd (no pastebin/video-sharing sites)
  • If you encounter PII/regulated data: stop (further actions unauthorized)

Not accepted

  • Customer private keys exposed by customers/employees
  • Stored XSS impacting only the originating account is out of scope
  • Clickjacking on non-sensitive pages
  • Password/email/account policy issues (case-by-case)
  • CSRF on unauthenticated/non-sensitive forms
  • Physical/wireless attacks
  • Social engineering
  • Software version disclosure
  • Known vulnerable libraries without a working PoC
  • DoS/DDoS
  • Content spoofing/text injection without an attack vector
  • Rate-limiting/brute-force on non-auth endpoints
  • Missing CSP best practices
  • Missing HttpOnly/Secure on non-sensitive cookies
  • Missing email best practices (SPF/DKIM/DMARC)
  • CSRF on logout without a non-trivial PoC
  • Host header injection unless it steals user data
  • Outdated-browser-only issues
  • Banner/version/error-message disclosure
  • Public zero-days patched <1 month (case-by-case)
  • Automated tool/scan reports
  • Tabnabbing
  • Open redirect without added impact
  • Issues requiring unlikely user interaction

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 3 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2023-0874 Medium 4.8 10 Apr 2023
CVE-2023-25456 Medium 5.9 23 Mar 2023

Original policy

Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

Your participation in our Bug Bounty Program (“Program”) is voluntary. By submitting a report or otherwise disclosing a vulnerability to us (making a “Submission”), you are indicating that you have read and agree to follow the rules for this Program as stated below. Thank you for helping keep Klaviyo and our users safe. Good luck and happy hunting! Confidentiality & Coordinated Disclosure Any information you receive or collect about us, our affiliates, or any of our users, employees, or agents in connection with the Bug Bounty Program ("Confidential Information") must be used only in connection with the Program. This is a public program operating under coordinated disclosure . You may request public disclosure of a resolved Submission by submitting a disclosure request through the Bugcrowd platform. Public disclosure is permitted only after the issue has been remediated and you have received Klaviyo's prior written consent. Until then, you may not use, disclose, or distribute any Confidential Information — including details of your Submission. Please follow Bugcrowd's disclosure guidelines . Not all requests for public disclosure can be approved. Rights and Licenses We may modify the Program Terms or cancel the Bug Bounty Program at any time. By making a Submission, you represent and warrant that the Submission is original to you and you have the right to submit it, and you grant us the right to use your Submission for any purpose. Failure to act in good faith will result in immediate disqualification and ineligibility for any benefit of the Program.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Klaviyo not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Eligibility Be 18+ years of age Not be in violation of any national, state, or local law or regulation with respect to any activities directly or indirectly related to the Bug Bounty Program Not be a resident of, or make submissions from a US- or UN-sanctioned country Not be using duplicate Bugcrowd accounts Not be employed by Klaviyo or any of our affiliates or a family member of a person employed by Klaviyo and any of our affiliates. In addition, former Klaviyo employees are not allowed to participate. Program Rules Provide detailed reports with reproducible steps; otherwise the report is not eligible for a reward. True impact needs to be demonstrated, simply popping up an alert box for XSS does not clearly identify impact but showing that cookies are vulnerable and can be exfiltrated through XSS would, for example. Actionable remediation steps (beyond generic advice) References to related CVEs/resources Use your Bugcrowd email address when signing up to the Klaviyo platform. Submit one vulnerability per report unless chaining is required. Duplicates: only the first fully reproducible report is awarded. Multiple vulnerabilities from one underlying issue = one bounty. Social engineering (phishing, vishing, smishing) is prohibited; reliant findings rewarded only at our discretion. Make a good-faith effort to avoid privacy violations, data destruction, and service degradation. Only interact with accounts you own or have permission to access. Be respectful of our infrastructure/application. Automated form spam will not be rewarded and may result in a ban. Attacking customer accounts is strictly prohibited . Enumerating the /api/v1/people path is not covered by our safe harbor, single tests on the base path with no page argument or "page=1" are covered by safe harbor. Targeting the public IP space of 20.* belonging to Microsoft is out of scope; we utilize a private IP space that overlaps their public IP space but is only reachable on VPN / leveraging an attack that can hit internal IP space Responsible Disclosure (Reporting Standards) Walk through the attack scenario in detail with screenshots Include a security-impact assessment; avoid generic PoCs (javascript:alert(1)) — demonstrate real exfiltration/unauthorized action Include written reproduction steps (video-only may be ineligible) Keep all information on Bugcrowd (no pastebin/video-sharing sites) If you encounter PII/regulated data: stop (further actions unauthorized) Report immediately Do not save/copy/store/transfer/disclose/retain For SQLi limit rows returned Delete all local/stored/cached copies ASAP (we may request a certificate of destruction) Access / Credentials Create a free account with "Bugcrowd" in the Company Name (e.g. Klaviyo-Bugcrowd). If that breaks a test, place "Bugcrowd" elsewhere (email +Bugcrowd, or last name). Roles per the User management & privileges reference. Premium / paid features — invitation only . Some features require a premium or paid subscription. Access to premium and paid features is provided on an invitation-only basis . Klaviyo provides premium access to selected researchers at its sole discretion; unsolicited requests for premium access are not accepted. Severity, Rewards, & Duplicate Handling Severity is assessed using Bugcrowd's Vulnerability Rating Taxonomy (VRT) , mapped to P1–P5 . Final severity is determined by Klaviyo based on demonstrated real-world impact and is at Klaviyo's sole discretion. Where the VRT baseline and demonstrated impact differ, impact governs . Reward Structure: Bounty criticalities and payments are at Klaviyo's discretion. There could be submissions for which we accept the risk and will not fix. P1: $2,100 - $3,500 (e.g. arbitrary code/command execution on a Klaviyo production server or arbitrary SQL queries on Klaviyo databases) P2: $1,000 - $1,750 (e.g. sensitive user/Klaviyo data in a publicly exposed resource (S3 bucket), privilege escalation within the application) P3: $450 - $600 (e.g. XSS; bypassing CSRF validation for low risk actions) P4: $150 - $200 (determined by the Klaviyo team based on potential impact) P5: $0 - $50 (determined by the Klaviyo team based on potential impact) Duplicate Rules: Only the first fully reproducible report of a unique underlying issue is eligible for a reward; later reports of the same issue are marked Duplicate and not rewarded. Multiple vulnerabilities stemming from one underlying root cause are awarded a single bounty . Submit one vulnerability per report , unless chaining is required to demonstrate impact. Response Targets (SLA) Klaviyo commits to the following engagement targets for valid submissions (business days): Time to first response: 3 Time to triage/validation: 5 Time to reward decision: within 5 of triage Validated findings are routed to the owning engineering team and remediated on a risk-based timeline prioritized by severity . Focus Areas We encourage research on Klaviyo's newest features, listed below. Stay within the in-scope targets and rules above (own/authorized accounts only; attacking customer accounts is strictly prohibited). Full list: https://www.klaviyo.com/whats-new . AI Agents — Composer, Customer Agent, Social Insights Agent. Prompt injection via attacker-controlled context, agent tool abuse, and cross-tenant data exposure in generated output. Customer Agent — Profile Enrichment & Multilingual. Injection into profile fields written from conversation input, and authorization on profile writes. Social Marketing — Instagram Integration. OAuth/connection flow, SSRF via media URLs, and stored XSS from ingested comments/UGC. Custom Object Expansion — Snowflake / BigQuery. Outbound connection config (SSRF, credential handling) and injection into segmentation queries. WhatsApp Enhancements & Website Personalization. Injection through collected/quiz input and XSS in storefront banners/recommendations. Email Open Tracking Consent. Authorization/IDOR on tracking preference changes. Coming soon (not yet generally testable): Multi-Branch Flows. Broken Access Control Submissions BAC findings must show clear malicious impact or attacker benefit to rate P4+. BACs based only on doc-vs-reality discrepancy without malicious impact are Informational. Final severity at Klaviyo's discretion. Excluded Vulnerability Types Customer private keys exposed by customers/employees (report to the customer directly; do not disclose the Klaviyo program; share with Klaviyo only if customer unresponsive/unidentifiable or impact exceeds a single account) Stored XSS impacting only the originating account is out of scope; stored XSS impacting email recipients or other accounts is in scope Clickjacking on non-sensitive pages Password/email/account policy issues (case-by-case) CSRF on unauthenticated/non-sensitive forms Physical/wireless attacks Social engineering Software version disclosure Known vulnerable libraries without a working PoC DoS/DDoS Content spoofing/text injection without an attack vector Rate-limiting/brute-force on non-auth endpoints Missing CSP best practices Missing HttpOnly/Secure on non-sensitive cookies Missing email best practices (SPF/DKIM/DMARC) CSRF on logout without a non-trivial PoC Host header injection unless it steals user data Outdated-browser-only issues Banner/version/error-message disclosure Public zero-days patched <1 month (case-by-case) Automated tool/scan reports Tabnabbing Open redirect without added impact Issues requiring unlikely user interaction Temporary Excluded Vulnerabilities pantheon.io subdomain takeovers Device Verification Token Bypass Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), with no legal action for accidental good-faith violations Exempt from the Digital Millennium Copyright Act (DMCA) Exempt from restrictions in our Terms & Conditions that would interfere with researcher (waived on a limited basis) Lawful, helpful, and conducted in good faith You must comply with all applicable laws If uncertain whether your research is consistent with this policy, please inquire via Bugcrowd Support before proceeding.

In Scope (in scope)

Target Information Klaviyo infrastructure includes our office IP addresses and VPN endpoints Documentation API Documentation Web Application Documentation