Prezi

By Prezi Inc. Vulnerability disclosure program on Self-hosted prezi.com

Accepting reports

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No You acknowledge that Prezi has not offered or promised any reward or bounty payment for your participation in the Program.
Response: Within 5 days We will acknowledge receipt of your report within five business days
Safe harbor: Partial We encourage and allow you to conduct security research and vulnerability testing on Prezi services and products to which you have authorized access on the “prezi.com” domain.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

1 asset you may test, 12 excluded.

Out of scope (12)

What the policy asks of you, and the bug types it won't reward, quoted from Prezi's policy. "We" in these lines means the program, not this site.

Never attempt to access someone else’s account or data; please always use your own account(s) for testing.
Never try to modify or destroy any data that does not belong to you.
Do not attempt or launch a denial of service attack.
Do not attempt or execute social engineering attacks (including but not limited to unsolicited or unauthorized emails, spam, or other forms of unsolicited messages).
Do not test third parties that integrate with Prezi services
Do not operate directly or indirectly with malicious or harmful software.
Don’t do anything that violates any applicable law.
please always resolve our subdomains before any testing to verify that they are not pointing to some external / 3rd party service.

Missing “HTTP only” flag for cookies, which are not the following ones: auth-sessionid, prezi-auth, sessionid
Missing “Secure” flags for any cookie
Username / user id enumeration
Missing “X-Frame-Options”, “Strict-Transport-Security”, “Nosniff”, “X-Xss-Protection” headers
Phishing by navigating password tabs a.k.a "window.opener" (reason)
Absence of rate limiting
Denial of Service
User password brute force attack
"Leakage" of publicly available information (e.g.: server version info in response header)

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake