Postman

By Postman, Inc. Vulnerability disclosure program on Self-hosted postman.com

Accepting reports

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

9 assets you may test, 13 excluded.

Out of scope (13)

What the policy asks of you, and the bug types it won't reward, quoted from Postman's policy. "We" in these lines means the program, not this site.

Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
Please use test accounts to research security issues that are likely to compromise the privacy of other users.
Interact with accounts you own or with the explicit permission of the account holder.
Please refrain from using automated tools to report vulnerabilities.
Do not perform DoS or DDoS attacks.
Your vulnerability report should not contain proof-of-concept using an account that you do not own or have permission for.
Issues of the same nature should be reported under a common vulnerability report.
Kindly refrain from splitting up a common source or class of vulnerabilities into multiple reports as that will slow down the resolution and credibility of subsequent reports.
To ensure that a vulnerability is resolved before it is exploited with malicious intent, it must not be publicly disclosed prior to resolution.
The vulnerability report must contain all information (such as IP address, username, etc.) that will allow us to track and isolate the activities performed by you.

Attacks requiring physical access to a user's device or a user's local network.
Missing best practices in Content Security Policy.
Missing email best practices (Invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.).
Vulnerabilities only affecting users of outdated or unpatched browsers / platforms.
Denial of service attacks caused only by a large volume of requests or massive brute-force attempts.
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
Open redirect - unless an additional security impact can be demonstrated.
IP stealing through images in markdown.
Missing HttpOnly or Secure flags on cookies.
Issues related to the usage of vulnerable libraries without an exploit.
Disclosure of internal IP address.
CSRF without any security impact.
'Best practice' recommendations without an exploit.
Findings from automated tools without an exploit.
Weak password policies.
User/Team enumeration.
Session fixation.
Tabnabbing.
HTTP communication on ra.postman.co.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake