Pokee AI
Vulnerability disclosure program on Self-hosted pokee.ai
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 10
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
All rewards are issued as Pokee API credits to the eligible reporter's Pokee API account. Rewards are not cash payments and cannot be exchanged for cash or transferred to another account.
- Safe harbor
-
Full
We consider security research conducted in accordance with this policy to be authorized. We will not pursue legal action against researchers who discover and report vulnerabilities responsibly and in compliance with the rules above.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
10 assets you may test, 8 excluded.
APIs 3
- api.pokee.ai
- api.pokee.ai — public-facing API endpoints No bounty
- public-facing API endpoints No bounty
Domains 3
- main website and web application No bounty
- pokee.ai
- pokee.ai — main website and web application No bounty
Products and areas 4
- Authentication and authorization mechanisms
- Payment and billing flows
- PokeeClaw environment isolation
- User data handling and storage
Out of scope (8)
- Clickjacking on pages with no sensitive actions
- Denial-of-service (DoS/DDoS) attacks
- Missing security headers that do not lead to a demonstrable exploit
- Reports from automated scanners without a demonstrated proof of concept
- Social engineering, phishing, or physical attacks against Pokee employees
- Spam or rate-limiting issues without a security impact
- Third-party services and integrations not operated by Pokee
- Vulnerabilities in outdated browsers or platforms we do not support
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Pokee AI's policy. "We" in these lines means the program, not this site.
While testing
-
Do not access, modify, or delete data belonging to other users. Use your own test accounts only.
-
Do not perform actions that could degrade service availability (e.g., DoS, brute force, excessive scanning).
-
Do not publicly disclose a vulnerability before we have had a reasonable opportunity to address it.
-
Act in good faith. Research should be conducted in a way that avoids privacy violations, data destruction, or service interruption.
-
One report per vulnerability. If you find multiple instances of the same class of bug, please group them into a single report.
-
You must be the first to report the vulnerability to be eligible for a reward.
-
Send reports only to [email protected]. Sending a bug report to any other Pokee AI email address will result in an immediate ban from the bug bounty program.
Not accepted
-
Spam or rate-limiting issues without a security impact
-
Clickjacking on pages with no sensitive actions
-
Missing security headers that do not lead to a demonstrable exploit
-
Reports from automated scanners without a demonstrated proof of concept
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.