Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

SimpliSafe Managed Bug Bounty Engagement

By SimpliSafe Bug bounty on Bugcrowd simplisafe.com

Accepting reports Full safe harbor
Go to program
Top reward
$6,000
Top severity paid
Critical
Assets in scope
24
Public CVEs
7
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $6,000
for critical bugs, from $175.
Report on Bugcrowd
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Public disclosure allowed
You may publish your report.

Rewards

What Bugcrowd lists as the payout for each severity.

Severity Reward
Critical $6,000 from $3,500
High $3,000 from $1,500
Medium $1,000 from $500
Low $500 from $175
Safe harbor
Full Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Earlier reward tables (1)
  • 11 Nov 2026 to 11 Nov 2026: Critical up to $6,000

Scope

24 assets you may test, 7 excluded.

APIs 10

  • api.prd.commerce.simplisafe.com
  • api.services.simplisafe.com (App Endpoints)
  • api.services.simplisafe.com (HSP Endpoints)
  • api.simplisafe.com (App Endpoints)
  • api.simplisafe.com (HSP Endpoints)
  • https://bb1.simplisafe.com
  • https://bb2.simplisafe.com
  • https://cb.simplisafe.com
  • media.simplisafe.com
  • mfa.simplisafe.com

Wildcard domains 8

  • *.prd.aser.simplisafe.com
  • *.prd.cam.simplisafe.com (app endpoints)
  • *.prd.cam.simplisafe.com (hsp endpoints)
  • *.prd.platform.simplisafe.com (app endpoints)
  • *.prd.platform.simplisafe.com (hsp endpoints)
  • *.prd.services.simplisafe.com (app endpoints)
  • *.prd.services.simplisafe.com (hsp endpoints)
  • *.prd.webapps.simplisafe.com

Web 4

  • https://simplisafe.com
  • https://simplisafe.co.uk
  • https://webapp.simplisafe.com
  • https://webapp.simplisafe.co.uk

Android apps 1

  • https://play.google.com/store/search?q=simplisafe&c=apps

iOS apps 1

  • https://apps.apple.com/us/app/simplisafe-home-security-app/id555798051
Out of scope (7)
  • auth.simplisafe.com
  • careers.simplisafe.com
  • clicks.simplisafe.com
  • library.simplisafe.com
  • livechat.simplisafe.com
  • press.simplisafe.com
  • support.simplisafe.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from SimpliSafe Managed Bug Bounty Engagement (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.

While testing

  • Use an account tied with your @bugcrowdninja.com email for all testing.
  • When testing exploits against our Ecommerce Platform, please do not make purchases.
  • Do not perform any testing on a system that you or others are actively using.
  • Be a good neighbor while testing our systems and refrain from activities that could affect system availability.

Not accepted

  • Brute force authentication requests
  • Denial of service
  • Web crawling bots
  • Social engineering
  • Physical attacks
  • Minor website misconfigurations such as 404 codes and others
  • Exposed credentials found on a breach database or similar
  • rate limiting (or lack thereof) submissions are considered Out of Scope.

Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 16 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2020-5727 Medium 4.6 2 May 2020
CVE-2019-3998 Medium 5.5 13 Feb 2020
CVE-2019-3997 Medium 4.6 16 Jan 2020
CVE-2018-11399 Medium 4.3 24 May 2018
CVE-2018-11400 Medium 4.6 24 May 2018
CVE-2018-11401 Medium 4.6 24 May 2018
CVE-2018-11402 Medium 6.6 24 May 2018

Original policy

Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

SimpliSafe's mission is to make every home secure. Delivering on that means putting our customers at the center of everything we do to improve their safety and comfort. Our home security solutions are designed with cutting-edge technology yet are affordable to purchase, easy to install and don’t require contracts. We protect more than four million people throughout the United States and the United Kingdom against everything from intruders to fires, water damage and more. As part of our commitment to our customers, we take data privacy and security issues very seriously. By engaging with talented security researchers across the globe through programs like Bugcrowd, SimpliSafe can more effectively identify and resolve suspected vulnerabilities. Thank you for participating in our program and helping protect SimpliSafe and its customers from potential threats. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Good luck, and happy hunting!

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of SimpliSafe not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to SimpliSafe, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation. Access Use an account tied with your @bugcrowdninja.com email for all testing. We will block and restrict suspicious activity from other accounts. Submissions that involve other email addresses will be marked as Out of Scope. All of the targets are accessible via the public internet and available. Simplisafe is designed for US and UK based customers. Access from other countries may inhibit testing. If you encounter a We are unable to create your account at this time error during account creation, reach out to Bugcrowd support or add a comment in a submission with your IP address and the email you used. When testing exploits against our Ecommerce Platform, please do not make purchases. Just include screenshots of the final checkout page with your cart, shipping address, and payment information. From there we can determine the applicability of the exploit. Our systems help keep millions of our customers safe. Testing and research on a system can impact its ability to do so. Do not perform any testing on a system that you or others are actively using. Be a good neighbor while testing our systems and refrain from activities that could affect system availability. We're co-workers now, so let's be kind to each other. Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . With that email address, you can perform a Forgot Password reset to gain access to the account. You may register for accounts here . PLEASE NOTE: Submissions that are created without using your @bugcrowdninja email will be marked as Out of Scope . Exclusions We do not allow and will not review submissions based on: Brute force authentication requests Denial of service Web crawling bots Social engineering Physical attacks Minor website misconfigurations such as 404 codes and others Exposed credentials found on a breach database or similar The auth.simplisafe.com subdomain handles authentication and is owned by Auth0. Since SimpliSafe doesn’t own the system, it is Out of Scope for testing and suspicious activity will be blocked. Normal behavior with this system is expected as part of testing. Any vulnerabilities found in our vendors’ products, e.g., third party software libraries, fall outside this policy’s scope and should be reported directly to the vendor according to their vulnerability disclosure policy. Obviously, if we are using a vulnerable library or component and are affected by the vulnerability, that would be a finding we want to be submitted. But just utilizing a library that has a vulnerability shouldn't be a qualified finding. N-Day Policy When N-Day bugs are released to the public, we will consider these as in scope after 14 days has gone by e.g: N-day released on 01/01/2023, we would consider it in-scope on 01/15/2023 Out of Scope auth.simplisafe.com Websites on subdomains linked to from simplisafe.com are out of scope. These include but are not limited to: careers.simplisafe.com clicks.simplisafe.com library.simplisafe.com livechat.simplisafe.com press.simplisafe.com support.simplisafe.com Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with Bugcrowd Support for clarification before proceeding.

SimpliSafe Home Security Platform - Backend (in scope)

SimpliSafe's Home Security Platform comprises of the hardware devices and software services that our customers rely on to keep them safe. The below targets are the public backend software components that facilitate communication with our devices. We want to encourage researchers to use our hardware while testing and will award higher payouts when hardware was required. Basestations establish connections and communicate with bb1.simplisafe.com and bb2.simplisafe.com Cameras establish connections and communicate with cb.simplisafe.com and *.prd.cam.simplisafe.com The Home Security Platform leverages APIs found at api.simplisafe.com and api.services.simplisafe.com , alongside communicating with services at *.prd.services.simplisafe.com

SimpliSafe Customer App (in scope)

The SimpliSafe Customer App is the primary way that our customers interact with their system through their smartphone or browser. We want to encourage researchers to use our hardware while testing and will award higher payouts when hardware was required for a submission. Authentication is handled by auth.simplisafe.com which is owned by Auth0 and is subject to their engagement terms . The subdomain is not in-scope of our engagement. MFA support comes from mfa.simplisafe.com . The Customer App's backend services are accessed through *.prd.aser.simplisafe.com and *.prd.webapps.simplisafe.com The Customer App leverages shared APIs found at api.simplisafe.com and api.services.simplisafe.com , alongside communicating with services at *.prd.services.simplisafe.com and *.prd.platform.simplisafe.com Video data is shared with the Customer App through media.simplisafe.com and *.prd.cam.simplisafe.com

SimpliSafe Ecommerce Platform (in scope)

simplisafe.com and simplisafe.co.uk are the front-end of SimpliSafe's Ecommerce Platform All calls to backend ecommerce services go through api.prd.commerce.simplisafe.com When testing exploits against our Ecommerce Platform, please do not make purchases. Just include screenshots of the final checkout page with your cart, shipping address, and payment information. From there we can determine the applicability of the exploit. All paths on the top-level domain are in scope. Webpages that are on a separate subdomain are out of scope.

Out of Scope Targets (out of scope)

While our systems are generally resilient to a high number of requests, until further notice, rate limiting (or lack thereof) submissions are considered Out of Scope.