- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report through their form
- app.intigriti.com/programs/dropbox/dropbox/detail
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 5 days
including an initial confirmation of your report within 5 business days of submission
- Safe harbor
-
Partial
Not pursue or support any legal action related to your security research;
- Hall of fame
-
Yes
Recognize, with your consent, your contribution on our Security Researcher List
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 5 excluded.
Domains 4
- app.reclaim.ai
- lifeworkcalendar.com
- lwc.ai
- reclaimai.com
Out of scope (5)
- Amazon Web Services (to the extent the issue is not at a Reclaim.ai application / service level)
- GitHub
- Google Cloud Platform / G-Suite
- Vercel
- https://reclaim.ai
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Reclaim.ai Inc.'s policy. "We" in these lines means the program, not this site.
While testing
-
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems and destruction of data during any security testing;
-
Perform security research only within the scope set out below;
-
Use the identified communication channels to report vulnerability information to us;
-
Do not take in any way advantage of the vulnerability or problem discovered;
-
Do not download, copy, transfer or publish any data and/or information that is exposed or accessible without contacting us first;
-
Do not use the vulnerability or data to gain access to the systems of Reclaim.ai;
-
Keep information about any vulnerabilities discovered confidential between yourself and Reclaim.ai until (i) we have had 60 days to respond and resolve the issue
Not accepted
-
Findings from physical testing (i.e., at offices, following employees, etc.)
-
Findings derived primarily from social engineering (i.e., phishing)
-
Findings from applications or systems not listed in the ‘Scope’ section
-
UI and UX bugs (i.e., copy errors, spelling mistakes)
-
Network level Denial of Service (DoS/DDoS) attacks
-
Any Personally Identifiable Information (PII), of other customers or employees;
-
Any customer’s privileged and/or client confidential information (i.e., preferences, calendar data, tokens)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.