Passbolt
Vulnerability disclosure program on Self-hosted passbolt.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 8
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
There is currently no financial reward for identified vulnerabilities.
- Response
-
Within 2 days
Acknowledging receipt of your report within 48 hours
- Safe harbor
-
Full
Not taking legal action against you for your research
- Hall of fame
-
Yes
Giving you credit for your findings (if desired)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
8 assets you may test, 8 excluded.
Source code 5
- passbolt_api
- passbolt_browser_extension
- passbolt_pro_api
- passbolt_styleguide
- passbolt-windows
Android apps 2
- mobile-passbolt-android
- mobile-passbolt-ios
iOS apps 1
- mobile-passbolt-ios
Out of scope (8)
- Passbolt network, online services, websites, and related 3rd party services/providers
- Vulnerabilities in development environments
- Vulnerabilities in third-party dependencies
- Vulnerabilities that are already known to us
- Vulnerabilities that are not reproducible
- Vulnerabilities that require physical access
- Vulnerabilities that require social engineering
- Vulnerabilities that require unrealistic user interaction
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Passbolt's policy.
While testing
-
Please do not use the public website for vulnerability testing.
-
You must be the first reporter of a valid vulnerability (any duplicate reports will not be rewarded).
-
Any submitted report must involve a bug that is exploitable in the latest version of Passbolt at the time of submission for both the server application and the clients.
Not accepted
-
Bugs that have been publicly reported in previous security audits and currently not fixed
-
Outdated development dependencies
-
Bugs that are reliant on pre-existing control of the victim's operating system (keylogger, memory dumping)
-
Bugs requiring the use of another malicious 3rd party browser add-on
-
Bugs resulting of the impersonation of another user when the passbolt registration is set to open
-
Bugs requiring the manual installation of a modified version of the passbolt web extension (by email, etc.)
-
Email content spoofing prompting a user to perform an account recovery on a different passbolt instance
-
Self inflicted password deletion or data damage even if they affect other users
-
Self inflicted XSS (using dev tools / console)
-
Issues related to baseline webserver such as the SSL certificate or configuration, outdated operating system and libraries, unsecure php configuration, etc.
-
Issues related to email configuration (DKIM, SPF)
-
Denial of service
-
Bugs that involve physical attacks or social engineering against passbolt contributors or add-ons / app store reviewers
-
Lack of Secure/HTTPOnly flags on non-sensitive cookies
-
Vulnerabilities in outdated versions of Passbolt
-
Username/email enumeration
-
CSV injection (OS Command Injection in CSV file export)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.