- Top reward
- $100
- Top severity paid
- Critical
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $100
- for critical bugs, from $10.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$100 |
| High |
|
$50 |
| Medium |
|
$25 |
| Low |
|
$10 |
- Top reward
-
$100
Critical │ $100 │ Issues that can lead to account takeover or broad compromise.
- Lowest reward
-
$10
Low │ $10 │ Informational issues or small-impact flaws.
- Safe harbor
-
Full
If you follow this policy, we will treat your research as authorized and will not initiate legal action or revoke access solely because you made a good-faith report.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 3 excluded.
Domains 2
- reedsy.com
- reedsy.com/website
Products and areas 1
- Reedsy-owned applications, public websites, APIs, and services that are reachable over the internet
Out of scope (3)
- Denial-of-service testing, rate-limit probing, or load testing.
- Issues requiring physical access, intercepted traffic on a user-owned network, or access to another party's accounts or devices.
- Social engineering, phishing, physical attacks, or attacks against employees or contractors.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Reedsy's policy. "We" in these lines means the program, not this site.
While testing
-
Do not access, modify, or destroy data that does not belong to you, and do not try to move from the issue you found into other accounts, services, or infrastructure.
-
Check with us first before trying something that could cause significant disruption.
-
Keep the proof of concept as minimal as possible, stop once you have confirmed the impact, and avoid disrupting service for other users.
-
Coordinate any public disclosure with us after we have had a reasonable chance to fix the issue.
Not accepted
-
Denial-of-service testing, rate-limit probing, or load testing.
-
Non-security bugs, feature requests, usability issues, and general product feedback.
-
Social engineering, phishing, physical attacks, or attacks against employees or contractors.
-
Issues requiring physical access, intercepted traffic on a user-owned network, or access to another party's accounts or devices.
-
Low-risk findings such as missing security headers, verbose error messages, or hardening suggestions without an exploit path.
-
Reports that only describe generic best practices or duplicate a previously reported issue.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.