- Top reward
- $2,000
- Top severity paid
- Not published
- Assets in scope
- 7
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $2,000
- top reward, from $25.
- Report through their form
- api.scribblemaps.com/vulnerabilities
- Partial safe harbor
- Some legal protection; read the terms.
- Paid by Wise, PayPal
- No identity requirement stated.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$2,000
Unrestricted file system or database access │ SQL injection, arbitrary file read/write │ $500 – $2,000
- Lowest reward
-
$25
Other valid security vulnerabilities │ CSRF, clickjacking, info disclosure, open redirect │ $25 – $200
- Safe harbor
-
Partial
Of course, your testing must not violate any law, or disrupt or compromise any data that is not your own.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
7 assets you may test, 5 excluded.
Web 6
- https://api.scribblemaps.com
- https://data.scribblemaps.com
- https://manage.scribblemaps.com
- https://team.scribblemaps.com
- https://widgets.scribblemaps.com
- https://www.scribblemaps.com
Domains 1
- scribblemaps.com
Out of scope (5)
- Anonymous community maps
- Missing security headers without a concrete attack scenario
- Rate limiting in isolation
- Third-party software we host but do not maintain
- Unlisted (URL-as-credential) maps
Rules
What the policy asks of you, and the bug types it won't reward, quoted from ScribbleMaps's policy. "We" in these lines means the program, not this site.
While testing
-
We generally prefer if you don't do these scans on us as hitting on with thousands of requests just puts unnecessary loads on our servers.
-
If you do a scan block the /maps/ path as this will send scanners down a rabbit hole
-
your testing must not violate any law, or disrupt or compromise any data that is not your own.
-
Accessing, altering, or exfiltrating other users' data beyond the minimum needed to demonstrate the issue
-
Coordinated disclosure is a condition of the program.
Not accepted
-
Saving over an anonymous map is not a vulnerability.
-
Accessing or saving such a map by knowing its map code is by design.
-
Issues in GeoServer, Tomcat, or other third-party stacks deployed alongside our services.
-
Reports about CSP, X-Frame-Options, HSTS, etc. without a working exploit are not eligible.
-
Lack of rate limiting on endpoints where rate limiting is not security-critical, without a demonstrated abuse scenario.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2021-34651 | The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the ~/includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2. | Medium 6.1 | 16 Aug 2021 |