- Top reward
- €3,500
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to €3,500
- for critical bugs, from €50.
- Report on Intigriti
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Intigriti lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
€3,500 from €1,000 |
| High |
|
€1,250 from €625 |
| Medium |
|
€500 from €325 |
| Low |
|
€100 from €50 |
- Safe harbor
-
Full
PDQ considers ethical hacking conducted following the established guidelines to constitute authorized conduct under criminal law.
Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 5 excluded.
Web 4
- https://app.pdq.com
- https://auth2.pdq.com
- https://library.pdq.com
- https://portal.pdq.com
Out of scope (5)
- https://a.simplemdm.com
- *.pdq.com
- *.pdq.tools
- *.simplemdm.com
- *.smartdeploy.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from PDQ bug bounty program (via Intigriti)'s policy. "We" in these lines means the program, not this site.
While testing
-
Do not perform scans. Scanning is strictly prohibited.
-
Prioritize quality over quantity.
-
Provide detailed but to-the-point reproduction steps.
-
Include a clear attack scenario and a step-by-step guide in the PoC.
-
Don’t discuss bugs before we fix them.
-
An @intigriti.me email must be used when registering for any accounts while testing as a security researcher.
-
Not discuss or disclose vulnerability information without prior written consent (including PoCs on YouTube and Vimeo)
-
Please destroy any licenses generated during your testing.
Not accepted
-
Arbitrary file upload lacking proof of the existence of the uploaded file
-
Blind SSRF with no proven business impact (pingbacks do not suffice)
-
CORS misconfiguration on nonsensitive endpoints
-
Clickjacking without proven impact or with unrealistic user interaction
-
Content injection without ability to modify the HTML
-
Cross-site request forgery with little to no impact
-
Email bombing
-
Email spoofing, SPF, DMARC, DKIM, or related anything related
-
HTTP request smuggling without proven impact
-
Host header injection lacking proven business impact
-
Missing cookie flags
-
Missing security headers
-
Not stripping metadata of files
-
Pre-auth account takeover & OAuth squatting
-
Presence of autocomplete attribute on web forms
-
Same-site scripting
-
Self-XSS unusable to exploit other users
-
Verbose messages, files, and directory listings without disclosing sensitive information
-
Violations of best practices (password complexity, expiration, reuse, etc.)
-
XMLRPC enabled
-
Brute force attacks
-
DoS/DDoS attacks
-
Spam, social engineering, and physical intrusion
-
Theoretical security issues that are not realistically exploitable
-
SSL/TLS scan reports and weak/expired SSL configurations
Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 4 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Status
Program status changed
-
Scope removed
https://portal.pdq.com/
-
Scope removed
https://*.pdq.com/ (out of scope)
-
Scope removed
https://*.pdq.tools/ (out of scope)
-
Scope removed
https://app.pdq.com/
-
Scope removed
https://*.smartdeploy.com/ (out of scope)
-
Scope removed
https://a.simplemdm.com/ (out of scope)
-
Scope removed
https://library.pdq.com/
-
Scope removed
https://auth2.pdq.com/
-
Scope removed
https://*.simplemdm.com/ (out of scope)
-
Scope added
https://auth2.pdq.tools/dev/mailbox
-
Scope added
https://www.pdq.com/
-
Scope added
https://library-staging.pdq.tools/
-
Scope added
https://portal-staging.pdq.tools/
-
Scope added
https://detect.pdq.tools/
-
Scope added
https://auth.pdq.tools/
-
Scope added
https://houston-staging.pdq.tools
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from www.intigriti.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
At PDQ our mission is to make device management simple, secure, and pretty damn quick. We know how important the security of our products is. We're a bunch of former sysadmins ourselves. Every decision we make revolves around ensuring our products are safe to use for managing your devices, which is why we have a bug bounty program. It’s a true win-win: We improve the security of our products, and you reap the rewards.
Rules of engagement
Guidelines
- Do not perform scans. Scanning is strictly prohibited.
- Prioritize quality over quantity.
- Provide detailed but to-the-point reproduction steps.
- Include a clear attack scenario and a step-by-step guide in the PoC.
- Don’t discuss bugs before we fix them.
Safe harbor for reasearchers PDQ considers ethical hacking conducted following the established guidelines to constitute authorized conduct under criminal law. PDQ won't pursue civil action or file a complaint for accidental, good faith violations. Similarly, PDQ won’t file a complaint for circumventing its technological measures used to protect the scope as part of your ethical hacking. If a third party initiates legal action against you and you have complied with the agreed upon terms, PDQ will verify your actions were conducted with our approval in compliance with our guidelines.
Requirements
- An @intigriti.me email must be used when registering for any accounts while testing as a security researcher.
By participating in this program, you agree to:
- Respect the Community Code of Conduct
- Respect the PDQ Terms of Use
- Respect the scope of the program
- Not discuss or disclose vulnerability information without prior written consent (including PoCs on YouTube and Vimeo)
Disclaimer
PDQ reserves the right to change or modify the terms of this program at any time. You may not participate in this program if you are a resident or individual located within a country appearing on any U.S. sanctions lists (e.g. Iran, North Korea, etc.), such as the lists administered by the U.S. Department of the Treasury’s OFAC.
License management
- Please destroy any licenses generated during your testing.
In scope
With this project, we aim to test and increase the security of our cloud environment. At the moment, this excludes our on-prem software, PDQ Deploy & Inventory and SmartDeploy.
Our worst-case scenarios are:
- Connect
- Authentication bypass
- Customer data exfiltration
- Package Library
- Data tampering
- Portal
- PCI leaks
- Customer data exfiltration
- License abuse
- Authentication
- Privilege escalation
- Authentication bypass
Feedback
Would you like to help us improve our program, or do you have some feedback to share? Please send your anonymous feedback via our program feedback form. Please note that we'll check this form periodically, and it should not be used for submission or support queries.
Out of scope
Application
- Arbitrary file upload lacking proof of the existence of the uploaded file
- Blind SSRF with no proven business impact (pingbacks do not suffice)
- CORS misconfiguration on nonsensitive endpoints
- Clickjacking without proven impact or with unrealistic user interaction
- Content injection without ability to modify the HTML
- Cross-site request forgery with little to no impact
- Email bombing
- Email spoofing, SPF, DMARC, DKIM, or related anything related
- HTTP request smuggling without proven impact
- Host header injection lacking proven business impact
- Missing cookie flags
- Missing security headers
- Not stripping metadata of files
- Pre-auth account takeover & OAuth squatting
- Presence of autocomplete attribute on web forms
- Same-site scripting
- Self-XSS unusable to exploit other users
- Verbose messages, files, and directory listings without disclosing sensitive information
- Violations of best practices (password complexity, expiration, reuse, etc.)
- XMLRPC enabled
- Payments
- PDQ Connect: per-device RBAC bypasses that do not result in a sensitive action being performable by the unauthorized user
- Out of scope: bypasses that only allow reading data associated with the device, or writing data that has no meaningful effect on that device (e.g. cosmetic fields, non-actionable metadata)
- In scope: any per-device RBAC bypass that lets an unauthorized user deploy packages, trigger/force automation runs, or otherwise meaningfully change device state
General
- Attacks requiring physical access to the target computer/device, machine-in-the-middle, or compromised user accounts
- Brute force attacks
- DoS/DDoS attacks
- Issues that would require complex end-user interactions for exploitation
- Recently discovered zero-day vulnerabilities found within 14 days of the public release of a patch or mitigation (these may be reported but are usually ineligible for a bounty)
- Reported vulnerabilities already known to PDQ from our own tests (will be flagged as a duplicate)
- Reports that software is out of date/vulnerable without a proof of concept
- Spam, social engineering, and physical intrusion
- Theoretical security issues that are not realistically exploitable
- Vulnerabilities that only work on end-of-life software
Infrastructure
- Open ports without proof of concept demonstrating a vulnerability
- Recently disclosed zero-day vulnerabilities in commercial products where no patch is available or a patch was released less than 2 weeks ago
- Like everyone, we need time to patch our systems — please give us 2 weeks before reporting these types of issues
- SSL/TLS scan reports and weak/expired SSL configurations
- Output from sites like SSL Labs
Severity
We use our triage standards, using CVSSv3 as a scoring system and applying a business impact modifier if needed.
FAQ
How do I sign up for a test account for your products?
- Use your @intigriti.me email to sign up for a trial account for PDQ Connect or SimpleMDM by visiting the site listed for that product.
- When you sign up for a trial of PDQ Connect that will give you access to Authentication, Portal, and Package Library.