Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Porch Group

Vulnerability disclosure program on security.txt porch.com

Accepting reports Full safe harbor security.txt
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
2
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 14 days
As the policy promises.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No At this time, Porch Group does not operate a formal bug bounty program with monetary rewards.
Response
Within 14 days Within 2 weeks
Safe harbor
Full Porch Group will not pursue civil or criminal action against researchers who make a good-faith effort to comply with this policy.
Hall of fame
Yes Researchers who report valid, in-scope vulnerabilities are credited publicly in our Hall of Fame (with their permission) upon resolution.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

2 assets you may test.

Domains 1

  • porch.com

Products and areas 1

  • Porch Group or any of its subsidiaries

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Porch Group's policy.

While testing

  • You must not access, modify, or delete data beyond what is minimally necessary to demonstrate the vulnerability.
  • Testing must be limited to accounts and data you own or have explicit permission to test.

Not accepted

  • Theoretical / Unlikely Attack Scenarios
  • Vulnerabilities only affecting users of unsupported or end-of-life browsers or operating systems
  • Broken link hijacking
  • Tabnabbing
  • Content spoofing and text injection issues
  • Attacks requiring physical access to a device
  • Self-exploitation: self-XSS, self-DoS (unless it can be used to attack another account)
  • Clickjacking on pages with no sensitive actions
  • CSRF on forms with no sensitive actions (e.g., logout)
  • Permissive CORS configurations without demonstrated security impact
  • Software version disclosure, banner identification, or descriptive error messages
  • CSV injection
  • Open redirects without demonstrated additional security impact
  • SSL/TLS configuration recommendations
  • Lack of SSL pinning in mobile apps
  • Lack of jailbreak detection in mobile apps
  • Cookie flags (missing HttpOnly / Secure)
  • Content-Security-Policy configuration opinions
  • Optional email security features (SPF, DKIM, DMARC)
  • Most issues related to rate limiting
  • Denial of service or distributed denial of service (DoS / DDoS)
  • Any testing that may affect availability of systems
  • Social engineering attacks (phishing, fake support requests)
  • Attacks that are noisy to users or admins (spamming notifications or forms)
  • Attacks against physical facilities

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 12 Nov 2026. Last checked 3 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.