- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 20
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Please note our disclosure program does not provide any monetary or non-monetary reward.
- Safe harbor
-
Partial
Unless required by law or law enforcement authorities, Move does not intend to initiate a lawsuit or law enforcement investigation against a security researcher who discovers and reports a security vulnerability in compliance with this Policy.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
20 assets you may test, 1 excluded.
Domains 10
- doorsteps.com
- fivestreet.com
- homefair.com
- listhub.com
- move.com
- moving.com
- opcity.com
- realtor.com
- relocation.com
- topproducer.com
Web 10
- https://www.doorsteps.com
- https://www.fivestreet.com
- https://www.homefair.com
- https://www.listhub.com
- https://www.move.com
- https://www.moving.com
- https://www.opcity.com
- https://www.realtor.com
- https://www.relocation.com
- https://www.topproducer.com
Out of scope (1)
- Any domains not expressly listed above
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Realtor's policy.
While testing
-
You must abide by the program scope.
-
You may only use or interact with your own accounts for testing purposes.
-
Do not attempt to compromise or otherwise gain access to an account you do not own.
-
Do not exploit a vulnerability you discovered for malicious purposes.
-
social engineering techniques (e.g., phishing);
-
Denial of Service (DoS) and Distributed Denial of Service (DDoS)-based attacks.
-
You are prohibited from engaging in any privacy violations, trading stolen user credentials, or destroying data.
-
You must securely delete Move information that may have been downloaded, cached, or otherwise stored on systems used to perform the research.
-
You are not permitted to disclose a vulnerability or otherwise share details about a vulnerability with a third party prior to resolution without Move’s express written permission.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.