Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Salv

Vulnerability disclosure program on Self-hosted salv.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
0
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No Note: We do not currently offer bounties or other rewards for submitted vulnerability reports.
Safe harbor
Full Not pursue or support any legal action related to your research;
Hall of fame
Yes Recognize your contribution to our Security Researcher Hall of Fame, if you are the first to report the issue and we make a code or configuration change based on the issue.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

0 assets you may test, 6 excluded.

Self-hosted does not list the scope of this program publicly. Check its policy.

Out of scope (6)
  • blog.veracode.com/2014/03/guidelines-for-setting-security-headers
  • Any services hosted by 3rd party providers and services.
  • Findings derived primarily from social engineering (e.g. phishing, vishing)
  • Findings from physical testing such as office access (e.g. open doors, tailgating)
  • Network level Denial of Service (DoS/DDoS) vulnerabilities
  • UI and UX bugs and spelling mistakes

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Salv's policy. "We" in these lines means the program, not this site.

While testing

  • Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing;
  • Perform research only within the scope set out below;
  • Use the identified communication channels to report vulnerability information to us; and
  • Keep information about any vulnerabilities you've discovered confidential between yourself and Salv until we have resolved the issue.
  • DoS and overloading server with many requests or large requests
  • Accessing and copying our customer data
  • Conducting research against our partners and customers
  • Abusing our services to conduct fraud
  • Spamming
  • Use of automated scanning tools

Not accepted

  • UI and UX bugs and spelling mistakes
  • Lack of rate limiting on any resources
  • Password policy issues, including lack of upper limit on passwords
  • SPF/DKIM/DMARC configuration issues
  • Descriptive error messages (e.g. Stack Traces, application or server errors).
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages.
  • Banner or version disclosure on common/public services/of any kind.
  • Disclosure of known public files or directories, (e.g. robots.txt).
  • Clickjacking and issues only exploitable through clickjacking.
  • CSRF on forms that are available to anonymous users (e.g. the contact form).
  • Logout Cross-Site Request Forgery (logout CSRF).
  • Presence of application or web browser 'autocomplete' or 'save password' functionality.
  • Lack of Secure and HTTPOnly cookie flags.
  • Lack of Security Speedbump when leaving the site.
  • Weak Captcha / Captcha Bypass
  • Username enumeration via Login Page error message
  • Username enumeration via Forgot Password error message
  • Login or Forgot Password page brute force and account lockout not enforced.
  • OPTIONS / TRACE HTTP method enabled
  • SSL Attacks such as BEAST, BREACH, Renegotiation attack
  • SSL Forward secrecy not enabled
  • SSL Insecure cipher suites
  • The Anti-MIME-Sniffing header X-Content-Type-Options
  • Missing HTTP security headers
  • Self-XSS issues

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 6 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.