Sovrn, Inc.
Vulnerability disclosure program on security.txt sovrn.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
No rewards or other remuneration will be issued for Submissions.
- Safe harbor
-
Partial
we waive those restrictions for the sole and limited purpose of permitting your security research under this Program.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test.
Domains 1
- sovrn.com
Products and areas 1
- Publicly accessible information systems, web property, or data owned, operated, or controlled by Sovrn.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sovrn, Inc.'s policy. "We" in these lines means the program, not this site.
While testing
-
agree not to post any information publicly without the direct and written consent from the Sovrn Chief Executive Officer, Chief Financial Officer, Chief Technology Officer or General Counsel
-
We require that detailed proof-of-concept exploit code and details that would make attacks easier on customers be withheld for 60 days after the vulnerability is fixed.
-
Please contact us at [email protected] before engaging in conduct that may be inconsistent with or unaddressed by this Program.
Not accepted
-
DoS, brute force, user enumeration or DDoS attacks
-
Any physical attacks against Sovrn property or data centers
-
Social Engineering, including phishing
-
Email flooding
-
Unconfirmed reports from automated vulnerability scanners
-
Reports related to permitted password strength
-
Theoretical subdomain takeovers with no supporting evidence
-
Reports exploiting the behavior of, or vulnerabilities in, outdated browsers
-
Logout CSRF, forms missing CSRF tokens (we require evidence of actual CSRF vulnerability)
-
Directory listing (unless sensitive data can be found)
-
Invalid or missing SPF/DKIM/DMARC records
-
Blackhat SEO techniques
-
Rate Limiting (Non-critical issues)
-
Lack of Secure/HTTPOnly flags on non-sensitive cookies
-
Generic examples of Host header attacks without evidence of the ability to target a remote victim
-
Missing Security HTTP Headers (without proof of exploitability)
-
Clickjacking on pages with no sensitive actions
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Autocomplete attribute on web forms
-
“Self” exploitation (such as Self-XSS)
-
Verbose error pages (without proof of exploitability)
-
Disclosure of server or software version numbers
-
Use of known-vulnerable library (without proof of exploitability)
-
Clickjacking / UI Redressing (without proof of exploitability)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.