- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 0
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Please note that Oviva does not offer a bug bounty program. This means that Oviva does not pay rewards for disclosed security vulnerabilities.
- Response
-
Within 2 days
Please do not make vulnerabilities public without notifying us and giving us at least 2 business days to respond.
- Safe harbor
-
Partial
To protect you and us please act in good faith and follow these rules of ethical engagement:
- Hall of fame
-
Yes
However, on a case by case basis, in consultation, we will consider providing public acknowledgement of your support.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
0 assets you may test.
Self-hosted does not list the scope of this program publicly. Check its policy.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Oviva's policy. "We" in these lines means the program, not this site.
While testing
-
Report the vulnerability to us in the manner set out above
-
Always comply with data protection rules and must not violate the privacy of our users, staff, contractors, services or systems
-
Report the vulnerability as soon as you can, to prevent that threat actors exploit the vulnerability before we have a chance to fix it
-
Report the vulnerability with us while keeping the information confidential (in particular if it concerns personal data).
-
Break any applicable law or regulations
-
Access unnecessary, excessive or significant amounts of data or modify data in our systems or services
-
Demand financial compensation in order to disclose any vulnerabilities
-
Disclose the vulnerability to others
-
Use social engineering to gain access to our IT infrastructure or services
-
Install your own backdoor in our systems to disclose the vulnerability as this may result in unnecessary damage and security risks
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.