Splitwise

Vulnerability disclosure program on Self-hosted splitwise.com

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No we do not offer cash rewards and will not negotiate a payout amount under threat of withholding the vulnerability
Response: Within 2 days Valid vulnerability reports will always be responded to as fast as possible – usually within 2 business days.
Safe harbor: Full Splitwise will not take legal action against users for disclosing vulnerabilities as instructed here.
Hall of fame: Yes Researchers who submit a valid report to us within the bounds of this policy will be given credit and thanks on this page once the submission has been accepted, remedied, and validated by our security team.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

6 assets you may test, 3 excluded.

Out of scope (3)

What the policy asks of you, and the bug types it won't reward, quoted from Splitwise's policy. "We" in these lines means the program, not this site.

Share the security issue with us in detail right away by emailing us at [email protected] .
Don’t perform any actions that could harm the reliability or integrity of our services and data.
Don’t use scanners or automated tools to find vulnerabilities.
Do not engage in social engineering or phishing of Splitwise users or employees.
Please give us a reasonable time to respond to the issue before making any information about it public.
Do not access or modify our data or our users’ data.
Do not view, alter, save, store, transfer, or otherwise access to any data obtained incidentally during your research, and immediately purge any local information after reporting the vulnerability to Splitwise.
Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services (including denial of service).
Comply with all applicable laws.

Our policies on presence/absence of SPF/DMARC records.
Password, email and account policies, such as email id verification, reset link expiration, password complexity.
Host header injections, unless you can show how they can lead to stealing user data.
Attacks requiring physical access to a user’s device.
Reports of spam (i.e., any report involving ability to send emails without rate limits).
Missing best practices (we require a repeatable proof of concept demonstrating a security vulnerability).
Any physical attacks against Splitwise property, offices, or employees.
Clickjacking on domains other than www.splitwise.com or secure.splitwise.com .
Accessing Pro features from free accounts (for example, bypassing daily expense limits)
Mobile app vulnerabilities specific to an OS version that is no longer receiving security updates

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake