SalesLoft

Vulnerability disclosure program on Self-hosted salesloft.com

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Response: Within 1.5 days We will acknowledge receipt within 36 hours of submission, but may require clarification following the initial report.
Safe harbor: Full We will make every effort to support your work and forego legal action, so long as you make every effort to align with our code of conduct.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

8 assets you may test, 1 excluded.

Out of scope (1)

What the policy asks of you, and the bug types it won't reward, quoted from SalesLoft's policy. "We" in these lines means the program, not this site.

Any user authenticated testing must be done so with either the express written permission of the Salesloft customer or within your own account with the consent of your organization.
Notice of testing must be given to Salesloft no less than 24 hours prior to testing.
Salesloft will not provide testing accounts.
Never publicize personally identifiable data.
Make a good faith effort not to access — and every effort not to destroy — a user’s data
Report vulnerabilities promptly after identification.
If any scope is unclear, request clarification/permission before testing (via email to [email protected] ).
Copy, transfer, store, or otherwise abuse sensitive information potentially exposed during your research.
Access or exploit data of others, including but not limited to our Users or Customers.
Publicly disclose vulnerabilities before our team has had time to acknowledge and subsequently remediate your findings.

Any testing except as expressly permitted herein
Denial of Service (DoS) – Either through network traffic, resources exhaustion or others
The use of any vulnerability testing tools that automatically generate very significant volumes of traffic.
Social Engineering (including phishing) or physical security attacks.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 6 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake