- Top reward
- €2,000
- Top severity paid
- Critical
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to €2,000
- for critical bugs, from €50.
- Report by email
- [email protected]
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
€2,000 |
| High |
|
€500 |
| Medium |
|
€200 |
| Low |
|
€50 |
- Top reward
-
€2,000
Critical vulnerability: 2000 euros
- Lowest reward
-
€50
Low-risk vulnerability: 50 euros
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test.
Domains 2
- api.spendesk.com
- app.spendesk.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Spendesk's policy. "We" in these lines means the program, not this site.
While testing
-
DO NOT USE automated scanners or tools that generate large amount of network traffic.
-
Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through the contact mentioned above
-
Denial of service (DoS) attacks on Spendesk applications, servers, networks or infrastructure are strictly forbidden.
-
Avoid tests that could cause degradation or interruption of our services.
-
Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
-
Do not copy any files from our applications/servers and disclose them.
-
No vulnerability disclosure, full, partial or otherwise, is allowed.
-
Always send a working proof of concept for any vulnerability you find.
-
If possible, include the CVSS score.
Not accepted
-
Known CVEs without working PoC or outdated libraries without a demonstrated security impact
-
Self-XSS or XSS that cannot be used to impact other users
-
Stack traces or path disclosure
-
Physical or social engineering attempts
-
Missing security-related HTTP headers or cookie flags which do not lead directly to a vulnerability
-
Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated
-
Product flow and decisions about email update and password reset.
-
Tabnabbing
-
Mixed content warnings
-
Clickjacking/UI redressing
-
Denial of Service (DoS) attacks
-
Open ports without real security impact
-
Presence of autocomplete attribute on web forms
-
Vulnerabilities affecting outdated browsers or platforms
-
Expired certificate, best practices and other related issues for TLS/SSL certificates
-
Reports with attack scenarios requiring MITM or physical access to victim's device
-
Cross-Site Request Forgery (CSRF)
-
Invalid or missing SPF (Sender Policy Framework), DKIM, DMARC records
-
Session expiration policies (no automatic logout, invalidation after a certain time or after a password change)
-
CSV injection without real security impact
-
Blind SSRF without direct impact (e.g. DNS pingback)
-
Lack of rate-limiting, brute-forcing or captcha issues
-
User enumeration (email, alias, GUID, phone number)
-
Password requirements policies (length / complexity / reuse)
-
Ability to spam users (email / SMS / direct messages flooding)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope
− Avoid tests that could cause degradation or interruption of our services
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.