- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $1,500
- for critical bugs, from $200.
- Report by email
- https://explore.sendsafely.com/security/bug-report
- No safe harbor
- No promise about legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$1,500 |
| High |
|
$500 |
| Medium |
|
$200 |
- Top reward
-
$1,500
Severity P1 $1,500 Cash reward
- Lowest reward
-
$200
Severity P3 $200 Cash reward
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test, 6 excluded.
Domains 1
- sendsafely.com
Wildcard domains 1
- all urls hosted under www.sendsafely.com
Products and areas 3
- Additional Info
- Bug Type
- Bug URL
Out of scope (6)
- All SendSafely customers
- Github
- Hubspot
- Stripe
- Systems within any other sub-domain of sendsafely.com
- Zendesk
Rules
What the policy asks of you, and the bug types it won't reward, quoted from SendSafely's policy. "We" in these lines means the program, not this site.
While testing
-
Testing should be performed only on systems listed as in scope under the "Testing Targets" section. Any other systems are Out Of Scope.
-
Except when otherwise described, you should create accounts for testing purposes.
-
Submissions must be made exclusively to our team using our Security Bug Reporting Form to be considered for a reward.
-
Do not use vulnerabilities to access, modify, harm, or otherwise alter any data that does not belong to you.
-
Do not exploit vulnerabilities except for purposes of demonstrating it to us.
-
Do not conduct network level or Denial of Service testing or traffic flooding attacks against our systems.
-
Do not conduct any tests that will impact the performance of the environment, such as aggressive scanning and/or aggressive scripting.
-
Do not target other SendSafely users or SendSafely customers. All SendSafely customers are out of scope and should not be targeted under any circumstances.
-
We encourage Researchers to include a video or screenshot Proof-of-Concept in their submissions. These files should not be shared publicly.
-
When completing the profile please use Last Name = SendSafelyBountyHunter to indicate you are a Bug Bounty tester.
Not accepted
-
Findings identified through physical testing of office access (e.g. open doors, tailgating).
-
Attacks conducted using social engineering (e.g. phishing, vishing).
-
Anything relating to an applications or system not listed in the above "Testing Targets" section.
-
Functional, UI and UX bugs and spelling mistakes.
-
Network level Denial of Service (DoS/DDoS) vulnerabilities.
-
Descriptive error messages (e.g. Stack Traces, application or server errors).
-
HTTP 404 codes/pages or other HTTP non-200 codes/pages.
-
Fingerprinting / banner disclosure on common/public services.
-
Disclosure of known public files or directories, (e.g. robots.txt).
-
CSRF on forms that are available to anonymous users (e.g. the contact form) and the Login/Logout URL.
-
Presence of application or web browser 'autocomplete' or 'save password' functionality.
-
Lack of HTTPOnly cookie flags.
-
Lack of Security Speedbump when leaving the site.
-
Login Brute Force (unless the CAPTCHA can be bypassed)
-
OPTIONS HTTP method enabled
-
Missing X-Content-Type-Options Header
-
Use of SHA-1 SSL Certificate and support for TLS 1.0
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.