Scalefusion
Bug bounty on security.txt scalefusion.com
- Top reward
- $1,000
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 5
- Last change
At a glance
What to know before you start testing.
- Pays up to $1,000
- top reward, from $50.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Paid by PayPal
- Proof of identity needed to get paid.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$1,000
The bounty amount can range from $50 - $1000 , we reserve the right to change the limit in future.
- Lowest reward
-
$50
The bounty amount can range from $50 - $1000 , we reserve the right to change the limit in future.
- Response
-
Within 2 days
We’ll respond as quickly as possible, but do give us 48hours to respond.
- Safe harbor
-
Full
We’ll not take any legal action against you if you adhere to the rules.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 2 excluded.
Domains 1
- mobilock.in
Web 1
- https://scalefusion.com
Out of scope (2)
- Issues that resolve to third-party services like Hubspot, Intercom, Calendly etc.
- Vulnerabilities on subdomains or assets that are not explicitly listed in the scope.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Scalefusion's policy. "We" in these lines means the program, not this site.
While testing
-
Avoid gaining access to another user’s account, devices, or data.
-
Do not perform attack that can impact the availability and reliability of our services or data. Running automated DDoS or SPAM attacks are not allowed.
-
Do not publicly disclose the bug before it gets fixed.
-
Do not use scanners or automated tools to find vulnerabilities as it creates lot of noise in our logs and we’ll be forced to ban your IP or suspend your account.
-
Attempts such as non-technical attacks i.e social engineering, phishing, attacks against our employees and users are not allowed.
-
Only sites listed below are allowed for security testing:
Not accepted
-
Previously reported issues which we’re already aware of or are in the process of fixing or have determined to be not eligible are out of scope.
-
Any activity that could lead to the disruption of service (DoS/DDoS).
-
User Enumeration via Login Page/Forgot Password page error message.
-
Timing attacks to prove the existence of a user.
-
A session is still valid after logout.
-
Clickjacking due to a lack of X-Frame-Options use.
-
Missing Security HTTP Headers.
-
Missing Best Practises like Password Strength and complexity.
-
TLS cookie without HttpOnly or Secure flag set
-
Insecure cookie settings for non-sensitive cookies.
-
Self-XSS
-
CSRF in unauthenticated or non-sensitive forms including Login/Logout CSRF.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Mail configuration issues including SPF, DKIM, DMARC settings.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Open redirection due to Header Injection: X-Forwarded-Host, X-Host, X-Server.
-
Email Spoofing.
-
Server Version Disclosure.
-
Attacks requiring MITM or physical access to a user’s device.
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
-
HTML Injection without any attack vector.
-
Bugs that don’t affect the latest version of modern browsers (Chrome, Firefox, Edge, Safari).
-
Bugs related to browser extensions are also out of scope.
-
Disclosure of public information and information that does not present significant risk.
-
Scripting or other automation and brute forcing of intended functionality.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
-
Scope +
Added to scope: mobilock.in
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2023-50159 | In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode. | High 8.8 | 11 Jan 2024 |
| CVE-2023-51748 | ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode. | High 8.8 | 11 Jan 2024 |
| CVE-2023-51749 | ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules." | High 8.8 | 11 Jan 2024 |
| CVE-2023-51750 | ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules." | Medium 4.6 | 11 Jan 2024 |
| CVE-2023-51751 | ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode. | Medium 6.8 | 11 Jan 2024 |