Level
Vulnerability disclosure program on security.txt level.io
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Level does not promise a bounty or payment unless it agrees to one in writing before the work is performed.
- Safe harbor
-
Full
Level considers research conducted in good faith and in accordance with this Policy to be authorized. For that research, Level will not initiate legal action under computer-access or anti-circumvention law
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 6 excluded.
Domains 1
- level.io
Products and areas 1
- Level-owned public websites, applications, APIs, and infrastructure that Level makes available to customers or the public
Out of scope (6)
- another customer’s account, data, or Endpoint
- a third-party service or integration outside Level’s control
- Automated testing that creates excessive traffic, repeated account creation, spam, or material operational cost
- Deleting, modifying, encrypting, downloading, or retaining data beyond the minimum needed to demonstrate the issue
- Denial of service, resource exhaustion, destructive testing, malware, persistence, or activity that degrades availability
- Social engineering, phishing, physical intrusion, or attacks on Level personnel, customers, or providers
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Level's policy.
While testing
-
Research must use accounts, workspaces, Endpoints, and data the researcher owns or is authorized to use.
-
A researcher should use the minimum testing needed to confirm and explain a vulnerability.
-
Do not include secrets or unnecessary Personal Information in ordinary email.
-
Give Level a reasonable opportunity to investigate and remediate a reported vulnerability before publishing technical details.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.