- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 0
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report through their form
- hackerone.com/sidefx/
- Partial safe harbor
- Some legal protection; read the terms.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
A reward may be awarded after verifying that the vulnerability is reproducible and has an impact to our customers.
- Hall of fame
-
Yes
SideFX would like to thank the following researchers for participating in our responsible disclosure program.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
0 assets you may test, 14 excluded.
Self-hosted does not list the scope of this program publicly. Check its policy.
Out of scope (14)
- Any man-in-the-middle attack (i.e. session hijacking after getting session ID via MITM attack)
- Brute forcing
- Cookie is not HttpOnly
- Cookie valid after logout, password change/reset
- CSRF possible to logout user
- Denial of Service attack
- General "best-practice" type reports without a clear impact or exploit are generally not accepted as qualifying bugs
- Issues with old browsers/plugins
- No maximum length restriction on passwords.
- Reflected XSS in preview mode of the Tutorials builder (tutorials are sanitized when submitted)
- Spelling and grammatical mistakes
- UI and UX bugs
- Username/email enumeration
- Vulnerability requiring social engineering or phishing to be performed
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sidefx's policy. "We" in these lines means the program, not this site.
While testing
-
Please avoid any privacy violations, degradations and disruption to our production system during your testing.
-
Do not attempt to brute-force or spam our systems .
-
Whenever possible, please delete any content you generated on the website if no vulnerabilities are found. E.g. comments, image gallery, tutorials, etc.
-
Please do not modify or destroy existing data.
-
Please keep information disclosed confidential between yourself and SideFX, until we resolve the issue.
Not accepted
-
Cookie valid after logout, password change/reset
-
Cookie is not HttpOnly
-
CSRF possible to logout user
-
Any man-in-the-middle attack (i.e. session hijacking after getting session ID via MITM attack)
-
Reflected XSS in preview mode of the Tutorials builder (tutorials are sanitized when submitted)
-
Username/email enumeration
-
No maximum length restriction on passwords.
-
Denial of Service attack
-
Brute forcing
-
General "best-practice" type reports without a clear impact or exploit are generally not accepted as qualifying bugs
-
Issues with old browsers/plugins
-
Vulnerability requiring social engineering or phishing to be performed
-
UI and UX bugs
-
Spelling and grammatical mistakes
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.