Mimecast
Vulnerability disclosure program on Self-hosted mimecast.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 14
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report through their form
- bugcrowd.com/
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 3 days
We shall endeavour to respond to your report within 3 business days of submission
- Safe harbor
-
Full
When you follow the guidelines that are laid out above, we will not pursue or support any legal action related to your research;
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 4 excluded.
Domains 2
- mimecast.com
- www.mimecast.com
APIs 1
- API
Products and areas 11
- Administration Console
- Aware
- DMARC Analyzer
- Large File Send (LFS) service
- MTA Servers
- Personal Portal
- POP Servers
- Secure Messaging (SM) service
- Service Monitor
- Unified Audit Utility
- Web Security
Out of scope (4)
- academy.mimecast.com
- kb.mimecast.com
- and anything else not explicitly named in the “In Scope” section above.
- https://community.mimecast.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Mimecast's policy. "We" in these lines means the program, not this site.
While testing
-
Perform research only within the “In Scope” set out in this Policy;
-
Keep information about any vulnerability you’ve discovered confidential between yourself and Mimecast until we have had at least 90 days to review and resolve the issue.
-
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing
Not accepted
-
TLS/SSL related issues;
-
SPF, DMARC, DKIM configurations;
-
Security headers missing or Content-Security Policies (CSP);
-
CAPTCHAs missing as a Security protection mechanism;
-
Lack of flags on cookies;
-
Username enumeration
-
Vulnerabilities in end-of-life products;
-
The ability to iFrame a page/clickjacking;
-
HTML injection without any security impact;
-
Account lockout or rate limit features;
-
CSRF attacks without any impact or that do not cross a privilege boundary;
-
Third party information/credential leaks that don't fall under Mimecast's control (e.g Google, Github, Pastebin etc);
-
Mimecast Product email sensitive links indexed in third party services when disclosed by customers, directly or indirectly;
-
Use of a known-vulnerable library without proof of exploitability;
-
3rd Party Vulnerabilities without advisory published or recently published (less than 30 days);
-
Vulnerabilities that have already been reported/fix in progress;
-
Subdomain takeover attacks without proof, a common false positive is smartlinggdn.mimecast.com;
-
Host header injections when the attack vector needs MITM or when the header is not reflected;
-
Information exposure (e.g Javascript files, API keys - Google maps) unless the data can be proven to be private;
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.