- Top reward
- $2,000
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $2,000
- for critical bugs, from $100.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Paid by PayPal
- Proof of identity needed to get paid.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$2,000 |
| High |
|
$1,000 |
| Medium |
|
$500 |
| Low |
|
$100 |
- Top reward
-
$2,000
Critical: USD 2,000
- Lowest reward
-
$100
Low: USD 100
- Response
-
Within 2 days
First Response - Within 2 business days from the date the Report is submitted.
- Safe harbor
-
Partial
By participating in the Bug Bounty Program, you hereby agree to release and hold harmless SquareX, its affiliates, and their respective officers, directors, and employees from and against any claim or cause of action arising out of your participation in the Bug Bounty Program
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 16 excluded.
Domains 2
- sqrx.com
- sqrxlabs.com
Wildcard domains 2
- sqrx.com website, domain, and subdomains
- sqrxlabs.com domain and subdomains
Products and areas 7
- Attacks on Kubernetes
- Breaking multitenancy i.e. viewing other user sessions
- Container breakout to host
- Disposable Browser and Disposable File Viewer launched via SquareX Chrome Extension / Web App
- Disposable Email feature in SquareX Chrome Extension and Web App
- Extending the lifetime of the container
- Getting Internet access inside the container
Out of scope (16)
- Accessing local files inside the container
- Bugs without security implications
- Clickjacking
- Cookie flags and headers-related issues
- Crashing the container
- Cross-Origin Resource Sharing (CORS) issues
- Denial of service
- Email and DNS-related issues, such as DMARC, SPF, etc
- Email Bomb
- File restriction bypass
- Firebase Configurations Leaks and Authentication Issues
- Google Analytics (any interaction with *.sqrx.com/track/*)
- Missing Security headers
- Rate Limiting
- Server Error Messages (unless critical information is leaked)
- TLS Version-related issues
Rules
What the policy asks of you, and the bug types it won't reward, quoted from SquareX's policy.
While testing
-
You must be the first reporter of the vulnerability
-
Vulnerability must be associated with a domain or application listed above and not applicable to the above exclusions
-
Vulnerability must have a clearly identified security impact and be presented with enough information for investigation and reproduction by the SquareX team
Not accepted
-
Email and DNS-related issues, such as DMARC, SPF, etc
-
Email Bomb
-
TLS Version-related issues
-
Denial of service
-
Rate Limiting
-
Crashing the container
-
Accessing local files inside the container
-
Firebase Configurations Leaks and Authentication Issues
-
Server Error Messages (unless critical information is leaked)
-
File restriction bypass
-
Cross-Origin Resource Sharing (CORS) issues
-
Clickjacking
-
Missing Security headers
-
Cookie flags and headers-related issues
-
Bugs without security implications
-
Google Analytics (any interaction with *.sqrx.com/track/*)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.