Tide

Vulnerability disclosure program on security.txt tide.co

Accepting reports Full safe harbor security.txt

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Response: Within 3 days Initial Acknowledgment: Within 3 business days of submission.
Safe harbor: Full If you conduct your security research and vulnerability disclosure activities in accordance with this policy, Tide will consider your research to be authorized. We will not initiate legal action against you, nor will we ask law enforcement to investigate you, provided you act in good faith and avoid
Hall of fame: Yes Public Attribution: Your alias listed on our public leaderboard.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

13 assets you may test, 13 excluded.

Out of scope (13)

What the policy asks of you, and the bug types it won't reward, quoted from Tide's policy. "We" in these lines means the program, not this site.

We request that this is done by adding the following header to your request: SecurityResearcher: <Name/Handle>
Do not try to exploit service providers we use, prohibited actions include, but are not limited to brute-forcing login credentials of Domain Registrars, DNS Hosting Companies, Email Providers and/or others.
If you are legally resident in a country in which Tide offers business accounts and meet the necessary criteria for an account in that region you may sign up for an account.
Please preserve as much evidence as possible.
we require that you keep all information about a discovered vulnerability confidential until Tide has formally closed the report and granted explicit permission for public disclosure

Reports from automated tools or scans
Reports affecting outdated browsers
Denial of Service Attacks
Content spoofing and text injection issues without showing an attackvector/without being able to modify HTML/CSS
Missing best practices in Content Security Policy.
Issues without clearly identified security impact or speculative theoretical exploitability
Use of known vulnerable libraries or frameworks without a clear and working exploit
Self-exploitation (cookie reuse, self cookie-bomb, self denial-of-service etc.)
Lack of HTTPS
Reports about insecure SSL / TLS configuration
Server Banner Disclosure/Technology used Disclosure
Full Path Disclosure
IP Address Disclosure
CSRF on logout or insignificant functionalities
Publicly accessible login panels
Clickjacking
Tabnabbing
Cache Poisoning
Open redirect - unless an additional security impact can be demonstrated
Social engineering of Tide employees or contractors
Any physical/wireless attempt against Tide property
Reports of broken links or unclaimed social media accounts
Issues that require unlikely user interaction

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 12 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

No Expires field

Read the file Among the top 42,000 websites

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake