- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 10
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Particle compensates security researchers based on the following factors:
- Response
-
Within 3 days
After submission, if your issue is accepted, you will hear from us within 72 hours.
- Safe harbor
-
Full
Particle will not engage in legal action against individuals or entities that submit vulnerability reports that cover in scope products and services (as defined above), through the approved channels (defined below).
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
10 assets you may test, 5 excluded.
APIs 1
- REST API
Domains 1
- particle.io
Products and areas 8
- Any publicly exposed infrastructure elements that support Particle’s product or organizational operations, e.g. public S3 buckets.
- Build
- Console
- Device Service
- Login/SSO
- Particle Device Cloud
- Particle DeviceOS (latest version)
- Webhook and integration system
Out of scope (5)
- Github repositories that are not part of the /particle-iot/ organization.
- Hardware vulnerabilities that require physical device access to exploit.
- Staging servers, unless their vulnerabilities impact production environments.
- Third party business applications leveraged by Particle:
- This includes the Particle blog, community forums and others.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Particle's policy. "We" in these lines means the program, not this site.
While testing
-
Testing and/or research should be non-disruptive (e.g. no denial of service), and should not harm Particle’s operations or customers.
-
Testing and/or research should be on in scope systems only.
-
Testing and/or research should not deliberately seek to access information belonging to Particle customers.
-
Security researchers should refrain from disclosing issues publicly prior to a mutually agreed upon disclosure date.
-
Security researchers are responsible for ensuring they adhere to local laws and legislation at all times.
-
To prove that you have read and understood this policy fully, include the word 'SPARKHEX' in the subject line of your submission.
Not accepted
-
Configuration and best practices such as SPF/DMARC, CORS, security headers, or insecure SSL/TLS ciphers.
-
Denial of Service.
-
Information disclosure such as file path, unless it can lead to sensitive info.
-
Clickjacking that does not exist in our in-scope web pages.
-
Email and account policies such as reset method and password complexity.
-
Theoretical XSS or Self-XSS attacks without evidence of exploitability, such as input being reflected in response.
-
Best Practices Concerns (including Rate Limit configuration).
-
Spam Techniques.
-
Social Engineering of Particle employees.
-
Vulnerability reports from automated tools.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− REST API
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.