Rocksurance Solutions
Vulnerability disclosure program on Self-hosted mynameflow.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report as the policy says
- The policy page explains how.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Our public program currently does not provide any monetary reward beyond our thanks and the appreciation of our users.
- Safe harbor
-
Full
Rocksurance Solutions will not seek judicial or law enforcement remedies against you for identifying security issues, so long as you (1) comply with the policies set forth herein
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 7 excluded.
Domains 1
- mynameflow.com
Products and areas 1
- MyNameFlow application
Out of scope (7)
- Any attack or vulnerability that hinges on a user's computer first being compromised
- Denial of Service (DoS) - Either through network traffic, resources exhaustion or others
- Disclosure of known public files and other information disclosures that are not a material risk (e.g.: robots.txt)
- Issues only present in old browsers/old plugins/end-of-life software browsers
- Phishing or social engineering of Rocksurance Solutions employees, users or clients
- Systems or issues that relate to Third-Party technology used by Rocksurance Solutions.
- User enumeration
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Rocksurance Solutions's policy. "We" in these lines means the program, not this site.
While testing
-
We ask that such vulnerability reports be kept private and researchers not make those public until we have resolved the issue.
-
if you discover a publicly exposed password or key, you should not use the key to test the extent of access it grants or to download or exfiltrate data in order to prove it is an active key
-
if you discover a successful SQL injection, you are expected not to exploit the vulnerability beyond any initial steps needed to demonstrate your proof-of-concept
-
Excessive exfiltration or downloading of MyNameFlow data, or demanding payment in return for destruction of MyNameFlow data, will be considered outside of the scope of this program
Not accepted
-
Denial of Service (DoS) - Either through network traffic, resources exhaustion or others
-
User enumeration
-
Issues only present in old browsers/old plugins/end-of-life software browsers
-
Phishing or social engineering of Rocksurance Solutions employees, users or clients
-
Systems or issues that relate to Third-Party technology used by Rocksurance Solutions.
-
Disclosure of known public files and other information disclosures that are not a material risk (e.g.: robots.txt)
-
Any attack or vulnerability that hinges on a user's computer first being compromised
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.