Stay22 Technologies Inc.
Bug bounty on security.txt stay22.com
- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Reward Structure (USD)
- Response
-
Within 5 days
Time to respond to report submissions: 5 business days
- Safe harbor
-
Full
For Authorized Activity carried out under the Program, Stay22 will not to initiate or pursue any legal action, claim, or proceeding against you, nor will we report you to the authorities or support any third party in bringing legal action against you for such Authorized Activity.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 2 excluded.
Domains 1
- stay22.com
Wildcard domains 1
- *.stay22.com domain and subdomains
Out of scope (2)
- Any 3rd party integrations to our web clients residing on domains outside of stay22.com .
- Any subdomain that redirects to 3rd party platforms not managed by Stay22.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Stay22 Technologies Inc.'s policy.
While testing
-
Test account creation must always use an AID with the prefix "bug-bounty", i.e a valid AID for testing would be "bug-bounty-security-test".
-
When creating a test account, always select the 0-5K range for visitors/traffic.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
When multiple vulnerabilities share a root cause, they should be aggregated under a single report, and will be triaged and validated as a single vulnerability.
-
Test accounts and test data created during vulnerability research should be carefully documented so proper clean up can be carried out once the Program process is complete.
-
All testing activity should be labeled using the custom header stay22-bug-bounty: username where username is the email address corresponding with your submission.
-
Social engineering attacks are strictly forbidden.
-
Security testing and research must avoid modification of files or data whenever possible.
-
You must not attempt to access, copy, or modify any real user data, including for personal information, unless it is strictly necessary to demonstrate a vulnerability.
Not accepted
-
Clickjacking without severe user implications
-
CSRF on requests which are not privileged
-
Software version disclosure, even when outdated
-
Stack traces, error messages, or other forms of information disclosure, as long as they do not leak sensitive information
-
Open redirects without severe user implications
-
Rate limiting bypasses or lack of rate limiting
-
Injection attacks without demonstrable impact on downstream systems
-
Use of end-of-life software
-
Man-in-the-middle conditions
-
User manipulation via injected text content (spoofing)
-
Attack vectors that require physical access to another user’s computer
-
Self-directed attacks that only impact the browser used for exploit
-
CORS misconfigurations without chained exploitation vectors
-
Missing or misconfigured HTTP headers, Cookies, CSP policies, or SSL/TLS
-
Blind SSRF evidenced only via DNS interaction
-
Attacks that involve destructive or disruptive testing with an impact on availability. This type of testing is strictly forbidden
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.