- Top reward
- $5,000
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- top reward, from $50.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Paid by Domestic ACH at a US bank, PayPal, check
- No identity requirement stated.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$5,000
The minimum bounty amount for a validated bug submission is $50 USD and the maximum bounty for a validated bug submission is $5,000 USD.
- Lowest reward
-
$50
The minimum bounty amount for a validated bug submission is $50 USD and the maximum bounty for a validated bug submission is $5,000 USD.
- Safe harbor
-
Full
if Spokeo determines that a disclosure complies with all the guidelines of these Program Terms and the Spokeo Agreements, we will not initiate a lawsuit or law enforcement investigation against you in response to your report.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 2 excluded.
Domains 3
- freepeopledirectory.com
- spokeoaffiliates.com
- spokeo.com
Wildcard domains 3
- *.freepeopledirectory.com
- *.spokeoaffiliates.com
- *.spokeo.com
Out of scope (2)
- community.spokeo.com
- spokeo.com/compass
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Spokeo's policy. "We" in these lines means the program, not this site.
While testing
-
You do not access, expose, modify, or destroy user data that does not belong to you
-
You avoid scanning techniques that may cause degradation of services to our users
-
You give us reasonable time to investigate an issue you report before making public any information about the report
-
You do not violate any other applicable laws or regulations
-
You may not publicly disclose your findings or the contents of your Submission in any way without Spokeo’s prior written approval.
-
Results in a degradation of Spokeo resources
-
Results in you, or any third party, accessing, exposing, modifying, or destroying Spokeo or customer data
-
May impact Spokeo customers, such as denial of service, social engineering or spam
-
All Submissions should be in English.
Not accepted
-
Vulnerabilities dependent upon social engineering techniques
-
Vulnerabilities dependent upon web browser add-ons
-
Vulnerabilities dependent upon outdated browsers
-
Security bugs in third-party websites that integrate with Spokeo
-
Denial of service (DoS)
-
Rate-limiting/Lack of Captcha based vulnerabilities
-
Host Header
-
Self-XSS
-
Login/logout CSRF
-
Content spoofing without embedded links/HTML
-
Certificates/TLS/SSL related issues
-
DNS issues
-
Server configuration issues
-
Information disclosure of public or information that does not present risk to Spokeo or or Spokeo customers (i.e. web server type disclosure)
-
Attacks involving brute force enumeration
-
Email spoofing of any of the Spokeo owned domains
-
“Best practice” or other non-exploitable issues.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.