Momentum Dashboard Corp.
Vulnerability disclosure program on security.txt momentumdash.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 10 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
We don’t run a paid bug bounty and can’t offer monetary rewards, but we are glad to credit you in the advisory.
- Response
-
Within 10 days
We will acknowledge a report that is in scope under this policy within 10 business days; if you haven’t heard from us by then, please send it again.
- Safe harbor
-
Full
If you make a good-faith effort to comply with this policy, we will consider your research authorized, we will not pursue or recommend legal action against you in connection with it, and if a third party brings action we will make it known that your research was authorized.
- Hall of fame
-
Yes
We don’t run a paid bug bounty and can’t offer monetary rewards, but we are glad to credit you in the advisory.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 2 excluded.
Domains 1
- momentumdash.com
Wildcard domains 1
- momentumdash.com and its subdomains
Products and areas 1
- our extension and apps on every platform we publish to, including unlisted and beta builds
Out of scope (2)
- Stripe
- Zendesk
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Momentum Dashboard Corp.'s policy. "We" in these lines means the program, not this site.
While testing
-
Please report to us before sharing the issue anywhere else.
-
Please don’t do any of this, even to demonstrate an issue: denial of service or load testing, social engineering or phishing aimed at our staff, customers or vendors, or physical attacks.
-
you test only against accounts and data that you own or are authorized to use
-
you do not access, modify, delete or retain anyone else’s data
-
you do not degrade the service for other people
-
you use only the access needed to demonstrate the issue and do not keep it
-
you comply with applicable law
-
If you encounter another person’s data, stop, don’t save a copy, and tell us what you saw and how you reached it.
-
If you’re unsure whether a test is in bounds, ask us before you run it.
Not accepted
-
denial of service or load testing
-
social engineering or phishing aimed at our staff, customers or vendors
-
physical attacks
-
Scanner output with no demonstrated impact: missing hardening headers, cookie flags, TLS preferences, version banners, self-XSS.
-
A known CVE in a dependency with no demonstrated path to exploiting it in what we ship.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.