- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs, from $150.
- Report on Bugcrowd
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 from $2,200 |
| High |
|
$2,200 from $600 |
| Medium |
|
$600 from $150 |
| Low |
|
$150 |
- Safe harbor
-
Partial
Testing is only authorized on the targets listed as in scope. Any domain/property of LastPass not listed in the targets section is out of scope.
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $5,000
Scope
13 assets you may test, 4 excluded.
Web 7
- https://accounts.lastpass.com
- https://admin.lastpass.com
- https://auth.lastpass.com
- https://blog.lastpass.com
- https://lastpass.com
- https://support.lastpass.com
- https://www.lastpass.com
Android apps 2
- https://play.google.com/store/apps/details?id=com.lastpass.authenticator&hl=en_US&gl=US
- https://play.google.com/store/apps/details?id=com.lastpass.lpandroid
iOS apps 2
- https://apps.apple.com/us/app/lastpass-authenticator/id1079110004
- https://apps.apple.com/us/app/lastpass-password-manager/id324613447
Products and areas 2
- https://lastpass.com/misc_download2.php
- Workstation MFA (WMFA)
Out of scope (4)
- Lastpass CLI tool
- https://forums.lastpass.com
- https://identity.lastpass.com
- https://info.lastpass.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from LastPass (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
When using automated tools, the requests should be limited to a maximum of 5 requests per second .
-
You must create accounts for testing purposes.
-
Only the first researcher to submit the vulnerability will be eligible for a reward.
-
Communication regarding submissions must remain within Bugcrowd and/or official Bugcrowd support channels for the duration of the disclosure process.
-
Actions which affect the integrity or availability of program targets are prohibited.
-
If you notice performance degradation on the target systems, you must immediately suspend all use of automated tools.
-
We require Researchers to include a video or screenshot Proof-of-Concept in their submissions demonstrating the vulnerability step-by-step.
-
These files must not be shared publicly on sites like YouTube, Imgur, Dropbox and others under any circumstances.
-
Before publishing, please provide a draft of the publication for our review in the submission's comment section.
-
Testing must be performed only on systems listed under the program brief 'In scope targets' section.
Not accepted
-
Denial of service, spam, or phishing attacks.
-
Attacks only possible on jailbroken or rooted mobile devices.
-
Attacks that would require Man-in-the-Middle (MitM) situations.
-
Memory dumps or issues found by tools that read active or cached memory.
-
Links that are indexed by Google, URL scan sites and publicly available information.
-
Broken client-side access control mechanisms.
-
Exclusions include "missing" security practices without viable attack scenarios or critiques of design choices.
-
Attacks performed by a malicious application or browser extension installed on the system.
-
Two-Factor Authentication (2FA) bypass for loading the user's local offline cache.
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 26 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
LastPass is a leading identity and password manager, making it easier to log in to life and work. Trusted by 100,000 businesses and millions of users, LastPass combines advanced security with effortless access for individuals, families, small business owners, and enterprise professionals. As an extended effort to make LastPass as secure as possible, we invite security researchers to contribute to this goal. Take part in our initiative to create a safer digital landscape. Good luck, and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Testing is only authorized on the targets listed as in scope. Any domain/property of LastPass not listed in the targets section is out of scope. Program Guidelines For researchers, enterprise features are also in scope of this bounty program. Targeting that part of the application will require you to create an enterprise or teams trial account. More information about the free trial can be found here . If you are an Enterprise customer of LastPass who believes they have discovered a potential vulnerability or security concern, we kindly ask you to contact your assigned Customer Success Manager or Customer Relationship Manager instead of submitting a submission to Bugcrowd. Customers can also submit a support ticket here or report it via email to [email protected] , where it will be escalated to the threat intelligence team. Communication with our security team should happen via Bugcrowd. From the submission of the issue until closing it, we will use Bugcrowd to communicate about the progress. When using automated tools, the requests should be limited to a maximum of 5 requests per second . We kindly request participants to adhere to this rate in order to ensure smooth collaboration. Public Disclosure Our policy for disclosing vulnerabilities aligns with the "Coordinated Disclosure" policy mentioned in Bugcrowd's Public Disclosure Policy . Researchers are allowed to publish mutually agreed information about the vulnerability after it has been fixed. Before publishing, please provide a draft of the publication for our review in the submission's comment section. Acceptance Criteria Our acceptance criteria for submissions follow Bugcrowd's Standard Disclosure Terms . Testing must be performed only on systems listed under the program brief 'In scope targets' section. Any other systems are Out-of-Scope. The submission must not be a part of the excluded submission types list. You must create accounts for testing purposes. Only the first researcher to submit the vulnerability will be eligible for a reward. Communication regarding submissions must remain within Bugcrowd and/or official Bugcrowd support channels for the duration of the disclosure process. Actions which affect the integrity or availability of program targets are prohibited. If you notice performance degradation on the target systems, you must immediately suspend all use of automated tools. Submissions must be related to the security posture of the target. In order to demonstrate its impact, your description should include a realistic scenario of a possible way to exploit the weakness you found. In case of debates, researchers might be asked to defend the impact in order to qualify for a reward. Bugs with no security implications will not be accepted. We require Researchers to include a video or screenshot Proof-of-Concept in their submissions demonstrating the vulnerability step-by-step. For more details, please refer to Bugcrowd's Reporting a Bug documentation. These files must not be shared publicly on sites like YouTube, Imgur, Dropbox and others under any circumstances. Violation of a program's stated disclosure policy will result in enforcement action as outlined in the Bugcrowd's Standard Disclosure Terms . Excluded Submission Types Denial of service, spam, or phishing attacks. Attacks only possible on jailbroken or rooted mobile devices. Attacks that would require Man-in-the-Middle (MitM) situations. Memory dumps or issues found by tools that read active or cached memory. Links that are indexed by Google, URL scan sites and publicly available information. Website-documented sharing limitations are out-of-scope due to inherent technical constraints. Please refer to our site for specific exclusions . Broken client-side access control mechanisms. While always helpful and appreciated to be reported on, client-side mechanisms generally run in an environment that is out of our control. Exclusions include "missing" security practices without viable attack scenarios or critiques of design choices. Submissions should focus on realistic threats with user impact, rather than emerging or theoretical best practices. Attacks against endpoints which enable username enumeration or brute forcing of credentials (for example login forms) when those endpoints already have reasonable rate limits in place. Distributed attacks using multiple IP addresses are also excluded. Attacks performed by a malicious application or browser extension installed on the system. On mobile we accept issues exploited by apps with limited privileges (e.g., if an app without any special permission could read the unencrypted passwords, that would typically be in scope). Two-Factor Authentication (2FA) bypass for loading the user's local offline cache. If the user's settings enabled offline access for 2FA and if the user has previously logged into the device, offline mode will override and bypass the required 2FA and allow the autofill access. This will not occur if the login is performed on a new device.
Additional information
This bounty requires explicit permission to disclose the results of a submission.