- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Profound may, in its sole discretion, choose to recognize or reward certain valid reports.
- Response
-
Within 5 days
Profound aims to acknowledge or respond to initial reports within 5 business days .
- Safe harbor
-
Full
If you make a good-faith effort to comply with this Policy while identifying and reporting a suspected security vulnerability, Profound will not initiate legal action against you based solely on your participation in this process.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 8 excluded.
Domains 1
- tryprofound.com
Wildcard domains 1
- *.tryprofound.com
Out of scope (8)
- denial of service or distributed denial of service activity
- issues involving only third-party services or applications that are not owned or controlled by Profound
- malware, ransomware, or destructive payloads
- physical security issues
- reports that lack enough detail for Profound to reproduce or evaluate the issue
- social engineering, phishing, or impersonation attempts
- spam, brute force, credential stuffing, or automated volumetric attacks
- third-party products, services, or infrastructure not controlled by Profound
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Profound's policy.
While testing
-
act in good faith
-
provide accurate and complete information
-
avoid any activity that disrupts, degrades, or impairs Profound systems or services
-
do not access, use, modify, disclose, or delete data that does not belong to you
-
report the issue privately to Profound and give Profound a reasonable opportunity to review and address it before any public disclosure
Not accepted
-
social engineering, phishing, or impersonation attempts
-
physical security issues
-
denial of service or distributed denial of service activity
-
spam, brute force, credential stuffing, or automated volumetric attacks
-
malware, ransomware, or destructive payloads
-
issues involving only third-party services or applications that are not owned or controlled by Profound
-
reports that lack enough detail for Profound to reproduce or evaluate the issue
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.