Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Squarespace

Vulnerability disclosure program on security.txt squarespace.com

Accepting reports security.txt
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
9
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
https://www.squarespace.com/vulnerability-reporting

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Scope

9 assets you may test, 16 excluded.

Domains 1

  • squarespace.com

Products and areas 8

  • Access Control Issues (ACI)
  • Cross-site Request Forgery (CSRF)
  • Cross-site Scripting (XSS)
  • Local File Disclosure (LFD)
  • Server-side Remote Code Execution (RCE)
  • Server-Side Request Forgery (SSRF)
  • SQL Injection (SQLi)
  • XML External Entity Attacks (XXE)
Out of scope (16)
  • All Squarespace customer websites or other customer content not owned by the researcher.
  • Application level Denial of Service.
  • Clickjacking or issues only exploitable through clickjacking.
  • Duplicate submissions that are being remediated.
  • Email or user enumeration.
  • Issues that require physical access to a victim’s computer.
  • Issues that require privileged access to the victim’s network.
  • Lack of email validation.
  • Lack of security-related flags on cookies.
  • Network level Denial of Service.
  • Password brute-forcing.
  • Password complexity guidelines.
  • Reflected File Download (RFD).
  • Self-XSS.
  • Vulnerabilities that are already known (e.g. previously discovered by an internal team or another researcher).
  • XSS issues that only affect outdated browsers.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Squarespace's policy. "We" in these lines means the program, not this site.

While testing

  • If you find a request that takes too long to respond, report it to us. Do not DoS the system.

Not accepted

  • Clickjacking or issues only exploitable through clickjacking.
  • Vulnerabilities that are already known (e.g. previously discovered by an internal team or another researcher).
  • Issues that require physical access to a victim’s computer.
  • Issues that require privileged access to the victim’s network.
  • Network level Denial of Service.
  • XSS issues that only affect outdated browsers.
  • Application level Denial of Service.
  • Duplicate submissions that are being remediated.
  • Lack of security-related flags on cookies.
  • Password complexity guidelines.
  • Password brute-forcing.
  • Lack of email validation.
  • Self-XSS.
  • Reflected File Download (RFD).
  • Email or user enumeration.

Summarised with AI from the company's policy, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.