- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Paid by PayPal
- No identity requirement stated.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Bounties will be paid in US dollars, via Paypal Goods & Services
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 11 excluded.
Web 3
- https://app.mintlify.com
- https://leaves.mintlify.com
- https://mintlify.com/docs
Domains 2
- dashboard.mintlify.com
- mintlify.com
Products and areas 1
- Mintlify GitHub apps
Out of scope (11)
- Attacks requiring interceptin of a valid user's network traffic
- Attacks requiring physical access to a victim's device
- Automated scanning
- Brute force attacks
- Clickjacking on pages with no sensitive actions
- DDOS attacks
- Denial of service attacks
- Missing headers in responses, except in cases where material harm or exploitation is evident
- Missing or insufficient rate limiting
- Social engineering, particularly involving Mintlify employees
- Theoretical attacks without proof of exploitability
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Mintlify's policy. "We" in these lines means the program, not this site.
While testing
-
Test the vulnerability on your own account. If testing on another account, make sure to have requested explicit permission
-
Do not copy or destroy production data
-
Do not engage in activities that will cause downtime for our services
-
Avoid violations to our privacy policies, terms of service, and other data privacy regulation
-
Do not make the vulnerability public before reporting it to us via the procedures above, and giving us enough time to properly address the issue
-
Do not attempt to reproduce or exploit these vulnerabilities on customer documentation without express permission and communication from the customer and Mintlify teams.
Not accepted
-
Automated scanning
-
Social engineering, particularly involving Mintlify employees
-
Missing or insufficient rate limiting
-
Missing headers in responses, except in cases where material harm or exploitation is evident
-
Brute force attacks
-
DDOS attacks
-
Clickjacking on pages with no sensitive actions
-
Theoretical attacks without proof of exploitability
-
Attacks requiring physical access to a victim's device
-
Attacks requiring interceptin of a valid user's network traffic
-
Denial of service attacks
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.