Practo
Vulnerability disclosure program on Self-hosted practo.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 2 days
We will respond as quickly as possible, generally takes 24-48 hours.
- Safe harbor
-
Full
We assure you that Practo will never pursue any legal action against users who report the issues, as long as they follow these guidelines.
- Hall of fame
-
Yes
our gratitude and sincerest thanks to you for helping us keep user data and services safe and secure by featuring you in our security hall of fame
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test, 3 excluded.
Domains 3
- blog.practo.com
- help.practo.com
- practo.com
Wildcard domains 1
- *.practo.com
Products and areas 1
- Practo mobile apps -- Android, iOS
Out of scope (3)
- Open-redirection
- Phishing attacks
- Self-XSS
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Practo's policy. "We" in these lines means the program, not this site.
While testing
-
Report your finding by writing to us directly at [email protected] without making any information public.
-
please do not publicly disclose the issue until it has been addressed by Practo within a reasonable timeframe.
-
please act in good faith towards our users' privacy and data during your disclosure.
-
Make every effort to avoid privacy violations, disruption to production systems, degradation of user experience and destruction of data during security testing.
-
This would include Brute Force, DoS, Spamming, Scraping, Social Engineering etc.
Not accepted
-
Phishing attacks using social engineering tricks to abuse users such as Self-XSS and Open-redirection.
-
Open-redirection is not considered vulnerable on its own.
-
Wordpress Users Disclosure
-
Wordpress DoS CVE-2018-6389
-
Wordpress CORS in wp-json
-
SPF Misconfiguration
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.