Natural Cycles
Bug bounty on security.txt naturalcycles.com
- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 10 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Eligible, valid findings may receive a monetary reward, determined by severity, impact, and quality of the report.
- Response
-
Within 10 days
You will receive an acknowledgement of receipt within 10 business days of disclosing the issue.
- Safe harbor
-
Partial
We will not pursue legal action against researchers who: Act in good faith, without fraudulent intent or intention to harm and in accordance with the program rules.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test.
Android apps 2
- Naturalcycles Android app
- Naturalcycles iOS app
Domains 1
- naturalcycles.com
Wildcard domains 1
- *.naturalcycles.com
Products and areas 1
- Naturalcycles Android and iOS apps
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Natural Cycles's policy. "We" in these lines means the program, not this site.
While testing
-
Do not exploit a vulnerability beyond what is necessary to demonstrate it.
-
Do not leverage a vulnerability to access, modify, delete, or exfiltrate user data or any personal and confidential data. Use only your own account(s) for testing.
-
Do not disrupt our services (e.g., through DDoS, brute force, or automated scanning).
-
Do not request any payment as a condition to report the vulnerability.
-
Do not discuss the vulnerability you have discovered with anyone other than us (the system owner) during the coordinated disclosure process.
-
Once you have reported a vulnerability, do not repeatedly interact with the affected system during the coordinated disclosure process.
-
Do not publicly disclose the identified vulnerability before we have investigated and remediated it.
-
If you plan to disclose your findings publicly, please communicate your intentions to us.
-
DOS attacks are not allowed
-
Installation of malware or viruses.
Not accepted
-
Generic clickjacking attacks
-
Issues related to DNSSEC configuration
-
Issues that cannot be reasonably addressed by Natural Cycles (e.g., how Firebase handles cache purge requests)
-
Vulnerabilities discovered by automatic scanners
-
Reports without demonstrable security impact
-
Reports of vulnerabilities that were discovered by non-compliance with the program rules
-
Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
-
Vulnerabilities that only work on software that no longer receive security updates
-
Reports that state that software is out of date/vulnerable without a proof-of-concept
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− *.naturalcycles.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.