- Top reward
- $10,000
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $10,000
- top reward, from $100.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
we may offer other forms of recognition or rewards, such as monetary rewards, swag, or other incentives, for valuable contributions
- Response
-
Within 7 days
SetPoint Medical will confirm we have received your submission as soon as possible – this will occur within no more than 7 calendar days.
- Safe harbor
-
Full
We assure researchers that we will not pursue legal action against individuals who discover and report vulnerabilities in good faith and compliance with this policy.
- Hall of fame
-
Yes
Whether the reporter would like to be publicly acknowledged for their discovery
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 8 excluded.
Domains 1
- setpointmedical.com
Products and areas 1
- SetPoint Medical products or systems
Out of scope (8)
- attacks against websites used solely for product marketing (setpoint medical devices interact with services on the setpointmedical.cloud domain)
- setpoint medical’s internal business systems (i.e., those that do not interact with setpoint medical devices or patient information)
- some categories of security reports are out of scope for our bug bounty reward program. these sorts of attack vectors often have already been considered and evaluated. reports related to the following areas are considered out-of-scope for the bug bounty reward system:
- while we cannot promise a response or reward for an out-of-scope category, all reports will still be considered and evaluated
- Already-reported issues
- Attacks that require physical disassembly of devices
- devices that are actively in use, or will eventually be used, by patients or healthcare providers
- Reports from automated scanning tools
Rules
What the policy asks of you, and the bug types it won't reward, quoted from SetPoint Medical's policy. "We" in these lines means the program, not this site.
While testing
-
The research does not cause harm to people or in-use devices – this includes activities that may result in denying access to service (e.g., brute force testing)
-
The research does not attempt to access user information other than the researcher’s own information
-
The research is never performed on devices that are actively in use, or will eventually be used, by patients or healthcare providers
-
Findings are reported to SetPoint Medical and reasonable time is allowed for remediation prior to public disclosure
-
We strongly encourage that all correspondence to our security teams be encrypted by utilizing our PGP Public Key .
Not accepted
-
Data that contains sensitive information (e.g., patient health information or personally identifiable details or individuals other than the reporter)
-
Keys or authorization tokens
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.