Piwik PRO
Bug bounty on security.txt piwik.pro
Accepting reports
Full safe harbor
security.txt
mentions bounty
- Top reward
- $3,000
- Top severity paid
- Critical
- Assets in scope
- 5
- Public CVEs
- 2
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $3,000
- for critical bugs, from $250.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- Paid by PayPal
- No identity requirement stated.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$3,000 |
| High |
|
$1,000 |
| Medium |
|
$500 |
| Low |
|
$250 |
- Top reward
-
$3,000
Critical : $3000
- Lowest reward
-
$250
Low : $250
- Response
-
Within 5 days
The Piwik PRO Security Team reserves the right to respond within 3 to 5 business days.
- Safe harbor
-
Full
Reports submitted in accordance with the program will not result in legal action. We will not report them to law enforcement if the reporters are acting in good faith.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test, 5 excluded.
Domains 3
- piwik.pro
- piwiksandbox.com
- website, all
Wildcard domains 1
- *.piwiksandbox.com
Products and areas 1
- Piwik PRO Analytics Suite
Out of scope (5)
- connected consent management tools
- Cookie Information consent management tool
- customer instances
- piwik.pro website
- production environments
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Piwik PRO's policy. "We" in these lines means the program, not this site.
While testing
-
Perform audit tests only using our Sandbox infrastructure on *.piwiksandbox.com
-
Please test only accounts you own in *. piwiksandbox.com domain.
-
Do not perform any testing in our production environments, especially on trial accounts created using any form other than the one available below.
-
Do not publicly disclose any details of the vulnerability, an indicator of vulnerability, or the content of the information rendered available by the vulnerability without explicit written authorization from Piwik PRO.
-
To protect our customers, researchers must not approach, notify, or communicate with any customer or third party about suspected vulnerabilities at any stage of the disclosure process.
-
Anonymize all sensitive data gathered during an attack. Ensure you secure and delete it after reporting.
-
Only low-rate automated scanning is accepted (e.g. with Burp/OWASP ZAP or similar tools).
-
Exfiltrating data – tests should be performed on the minimum amount of data necessary to confirm the vulnerability.
-
Violating any applicable laws or agreements to discover vulnerabilities.
-
Social engineering – such as phishing, fishing, or smishing on Piwik PRO staff and users.
Not accepted
-
Vulnerabilities affecting users of outdated or unsupported browsers or platforms.
-
Cross-site scripting bugs that require an unusual amount of interaction or significant user engagement.
-
Cross-site request forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
-
Missing CAPTCHA.
-
Password complexity or account recovery policies or methods.
-
HTTPS Mixed Content.
-
Issues without clearly identified security impact.
-
Missing headers alone are out of scope, but exploitable misconfigurations are in scope.
-
Invalid or missing SPF, DKIM, or DMARC records.
-
Weak SSL/TLS Cipher Suites. Theoretical cryptographic weaknesses without exploit scenario
-
Sending vulnerability reports using automated tools without validation.
-
Use of a known-vulnerable library without evidence of exploitability unless a working exploit path is demonstrated.
-
Attacks requiring physical access to an unlocked user device.
-
Reports of SPAM, phishing, or security best practices.
-
Software version disclosure / banner identification issues / descriptive error messages or headers (such as stack traces, application or server errors).
-
Missing cookie flags on non-sensitive cookies.
-
Users with superuser privileges posting arbitrary JavaScript (for example, via the Tag Manager module).
-
Tabnabbing.
-
Path disclosure.
-
Vulnerabilities already known and reported by other security researchers.
-
Stolen/Breached credentials.
-
Missing rate limiting without demonstrated impact / exploitation
-
Ability to enumerate users (e.g. via login, password reset) without additional impact
-
Open redirects without demonstrated phishing or token leakage impact
-
Clickjacking on non-sensitive pages
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2014-5871 | The Piwik Mobile 2 (aka org.piwik.mobile2) application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | Medium 5.4 | 11 Sep 2014 |
| CVE-2010-1453 | Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter. | Medium 4.3 | 7 May 2010 |