- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 3 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
No monetary compensation is offered or provided in connection with reporting vulnerabilities.
- Response
-
Within 3 days
We aim to reply within three (3) business days to acknowledge your report.
- Safe harbor
-
Partial
To protect you and us please act in good faith and follow these rules of ethical engagement:
- Hall of fame
-
Yes
On a case by case basis, in consultation, we will consider providing public acknowledgement of your support.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 3 excluded.
Domains 1
- shell.com
Products and areas 5
- Authentication or authorization flaws
- Encryption vulnerabilities
- Remote Code Execution
- Server-side code execution bugs
- SQL injection vulnerabilities
Out of scope (3)
- Comments about Shell services
- Reports on phishing campaigns or emails and/or viruses or malware
- Reports on (potential) fraud or compliance issues
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Shell's policy. "We" in these lines means the program, not this site.
While testing
-
report the vulnerability to us in the manner set out above;
-
report the vulnerability as soon as you can to prevent that threat actors exploit the vulnerability before we have a chance to fix it;
-
report the vulnerability with us while keeping the information confidential (jn particular if it concerns personal data);
-
do not disclose the vulnerability to others;
-
do not use social engineering to gain access to our IT infrastructure or services;
-
do not install your own backdoor in our systems to disclose the vulnerability as this may result in unnecessary damage and security risks;
-
do not exploit a vulnerability further than necessary to confirm the vulnerability finding;
-
do not copy, modify, or remove data from system (an alternative is to create a directory listing of the system);
-
do not modify the system;
-
do not use Denial of Service attacks or brute force access technology;
Not accepted
-
Comments about Shell services
-
Reports on (potential) fraud or compliance issues
-
Reports on phishing campaigns or emails and/or viruses or malware
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.