- Top reward
- $12,071
- Top severity paid
- Not published
- Assets in scope
- 13
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $12,071
- top reward, from $61.
- Report on GoBugfree
- Submit through the program page.
Rewards
What GoBugfree lists as the payout for each severity.
GoBugfree does not publish a reward table for this program.
Reward range in US dollars. GoBugfree's own page has the details.
Scope
13 assets you may test.
Domains 6
- apip.threema.ch
- billing.threema.ch
- broadcast.threema.ch
- gateway.threema.ch
- shop.threema.ch
- work.threema.ch
Wildcard domains 4
- g-*.0.threema.ch
- mediator-*.threema.ch
- rendezvous-*.threema.ch
- safe-*.threema.ch
Source code 3
- https://github.com/threema-ch/threema-android
- https://github.com/threema-ch/threema-desktop
- https://github.com/threema-ch/threema-ios
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
apip.threema.ch
-
Scope added
https://github.com/threema-ch/threema-ios
-
Scope added
https://github.com/threema-ch/threema-android
-
Scope added
billing.threema.ch
-
Scope added
shop.threema.ch
-
Scope added
gateway.threema.ch
-
Scope added
broadcast.threema.ch
-
Scope added
work.threema.ch
-
Scope added
*.threema.ch
-
Scope added
*.0.threema.ch
-
Scope added
https://github.com/threema-ch/threema-desktop
-
Scope removed
rendezvous-*.threema.ch
-
Scope removed
mediator-*.threema.ch
-
Scope removed
Android
-
Scope removed
g-*.0.threema.ch
-
Scope removed
safe-*.threema.ch
-
Scope removed
Desktop 2.x App
-
Scope removed
iOS App
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.