Net at Work
Vulnerability disclosure program on Self-hosted nospamproxy.de
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 90 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 90 days
We will endeavour to respond promptly and remedy the identified vulnerability within 90 days.
- Safe harbor
-
Full
We will not take civil action or file a complaint with law enforcement authorities for unintentional, bona fide violations of this Policy as amended.
- Hall of fame
-
Yes
In recognition of this, we would like to welcome you to our Hall of Thanks .
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test.
Domains 2
- nospamproxy.com
- nospamproxy.de
Products and areas 2
- all networked or network-capable products and components developed, manufactured or marketed by Net at Work
- all publicly available Net at Work IT applications
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Net at Work's policy. "We" in these lines means the program, not this site.
While testing
-
share the security incidents with us in detail;
-
To take our existing applications into consideration and not to disturb their operation;
-
To give us a reasonable response time before you disclose the information.
-
During this time we ask you to keep all communications and information confidential.
-
Not to access or modify our data or the data of our users without our express permission of the owner.
-
Please access only your own accounts or test accounts for security research purposes;
-
To contact us immediately if you accidentally come across data of other users.
-
Delete all local copies of the data immediately after reporting the vulnerability to the above Email addresses;
-
To act with good faith to avoid data breaches, data destruction and disruption or deterioration of our services (including denial – of – service); and to comply with all applicable laws.
Not accepted
-
reports of vulnerabilities with minimal security impact (e.g. missing headers)
-
unverified results of automated scans
-
vulnerabilities beyond Net at Work’s control
-
vulnerabilities that violate the requirements below
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.