Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

ReferralCandy

Bug bounty on security.txt referralcandy.com

Accepting reports security.txt
Go to program Website
Top reward
Not published
Top severity paid
Not published
Assets in scope
3
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays cash
Amounts are not published; ask before you invest time.
Report by email
[email protected]
Partial safe harbor
Some legal protection; read the terms.
Replies within 1 day
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash
Yes If applicable, we will inform you of your eligibility for a reward.
Response
Within 1 days Critical │ Within 1 business day │ Within 1 business day │ Within 3 days │ Within 7 days
Safe harbor
Partial Testing production without our approval is not authorized under this program.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

3 assets you may test, 5 excluded.

Domains 3

  • anafore.com
  • my.staging.anafore.com
  • referralcandy.com
Out of scope (5)
  • Issues affecting outdated browsers or platforms no longer supported by their vendors.
  • Reports from automated tools without clear analysis.
  • Spam-related vulnerabilities or excessive email rates.
  • Weak password policies or lack of email/account verification.
  • Well known exploits

Rules

What the policy asks of you, and the bug types it won't reward, quoted from ReferralCandy's policy. "We" in these lines means the program, not this site.

While testing

  • Avoid Denial-of-Service (DoS) attacks, spam, or any activity that could disrupt our systems or degrade service availability.
  • Refrain from using tools that generate excessive traffic during testing.
  • Use only test accounts that you created yourself or that we gave you.
  • Do not access or change data in any account that is not yours.
  • You must contact us and receive written approval before you deliberately test any of our production systems.
  • Do not spam our applications with automated vulnerability scanners.
  • Do Not Make Public Disclosures: Give us adequate time to respond and address the issue before discussing it publicly.
  • You must not alter, save, transfer, or interact with data that does not belong to you.
  • Testing must comply with applicable laws and must not intentionally disrupt other users or systems.

Not accepted

  • Weak password policies or lack of email/account verification.
  • Reports from automated tools without clear analysis.
  • Spam-related vulnerabilities or excessive email rates.
  • Issues affecting outdated browsers or platforms no longer supported by their vendors.
  • Well known exploits

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 12 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.