- Top reward
- $1,000
- Top severity paid
- Not published
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $1,000
- top reward, from $100.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Paid by PayPal
- No identity requirement stated.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$1,000
up to 1000$: vulnerabilities that compromise Spreaker’s private data and servers
- Lowest reward
-
$100
Rewards for qualifying bugs range from $100 to $1,000, sent to your PayPal account.
- Safe harbor
-
Partial
You need to show that you could exploit a vulnerability, but you must not actually exploit it.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 11 excluded.
Domains 1
- spreaker.com
Wildcard domains 1
- *.spreaker.com
Products and areas 2
- domain or IPs belonging to a non
- mobile applications
Out of scope (11)
- blog.spreaker.com
- careers.spreaker.com
- elasticemail.spreaker.com
- elasticmta1.spreaker.com
- elasticmta2.spreaker.com
- help.spreaker.com
- open.spreaker.com
- report.spreaker.com
- try.spreaker.com
- Any non spreaker.com domain or IPs belonging to a non spreaker.com domain
- third-party plugins / inclusions / websites
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Spreaker's policy. "We" in these lines means the program, not this site.
While testing
-
You need to show that you could exploit a vulnerability, but you must not actually exploit it.
-
If you are performing research, please use your own accounts and do not interact with other users’ accounts or data.
-
You must not leverage the existence of a vulnerability or access to sensitive or confidential data to make threats, extortionate demands, or ransom requests.
-
Your testing must not violate any applicable laws or regulations.
-
You must be 18 years of age or older.
-
You must not be employed by Spreaker or any of its affiliates.
Not accepted
-
Account squatting by preventing users from registering with certain email addresses
-
Attacks requiring MITM or physical access to a user’s device
-
Best practice reports without a valid exploit (for example, use of “weak” TLS ciphers)
-
Clickjacking on pages with no sensitive actions
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
-
Denial of service
-
Disclosure of server or software version numbers
-
Hypothetical subdomain takeovers without supporting evidence
-
Issues that require unlikely user interaction
-
Missing best practices in Content Security Policy
-
Missing best practices in DNS configuration (eg: DNSSEC)
-
Missing best practices in SSL/TLS configuration
-
Missing email best practices (invalid, incomplete or missing SPF/DKIM/DMARC records, and so on)
-
Missing HttpOnly or Secure flags on cookies
-
Open redirect - unless an additional security impact can be demonstrated
-
Perceived security weaknesses without concrete evidence of the ability to compromise a user (for example, missing rate limits, missing headers, and so on)
-
Previously known vulnerable libraries without a working Proof-of-Concept
-
Race conditions
-
Rate limiting or bruteforce issues on non-authentication endpoints
-
Reports exploiting the behavior of, or vulnerabilities in, outdated browsers
-
Reports of spam
-
S3 bucket (not owned by us)
-
Self-XSS
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.