Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Todoist

Vulnerability disclosure program on security.txt todoist.com

Accepting reports security.txt mentions bounty
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
6
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
https://todoist.com/contact?area=bug_bounty
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No They evaluate each report and assign a severity level that determines the amount of the Todoist Pro time to be received. The Pro time can only be received on your personal Todoist account.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

6 assets you may test.

Domains 5

  • app.todoist.com
  • todoist.com
  • twist.com
  • www.todoist.com
  • www.twist.com

Products and areas 1

  • Latest versions of Todoist and Twist for macOS, Windows, Linux, iOS and Android

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Todoist's policy. "We" in these lines means the program, not this site.

While testing

  • Follow HackerOne's disclosure guidelines .
  • Delete any test data or accounts you have created as part of the research.
  • Don't attack or interact with customers.
  • Don't engage with stolen customer data, including credentials.
  • Don't use automated scans or testing, like DoS attacks.
  • Don't use social engineering attacks, like phishing.
  • Don't engage in physical testing of Todoist employees or their equipment.
  • All information should be filled out in the report form. Please do not submit details in a separate document.
  • For testing purposes, use [email protected] as the victim account.
  • Report independent vulnerabilities in separate reports.

Not accepted

  • Issues not related to security, such as non-200 HTTP response codes, EXIF metadata exposure, application or server errors, etc.
  • Issues related to bypassing plan limits or rate limits through parallel requests, or missing rate limits, unless it could lead to an exploitable vulnerability.
  • Issues involving AI prompt disclosure, such as obtaining or exposing the system prompts used in our AI features (e.g., Ramble).
  • Issues affecting outdated applications or components, no longer in use or maintained.
  • Issues affecting third-parties, such as third-party apps or services we use (e.g., Firebase, ZenDesk).
  • Issues involving Spam or Social Engineering techniques, such as SPF and DKIM, and lack of DNSSEC.
  • Issues involving server information disclosure, namely X-Powered-by and Server response headers.
  • Issues related to users uploading files containing malicious code (e.g., viruses or malware).
  • Bugs requiring exceedingly unlikely user interaction. (eg. account takeover through SSO login).
  • Reports that require privileged access to the target's devices or that are otherwise outside our control.
  • Clickjacking issues that occur on pre-authenticated pages, or the lack of X-Frame-Options , or any other non-exploitable clickjacking issues.
  • Cross-OriginResourceSharing (CORS) issues, where server does NOT respond with Access-Control-Allow-Credentials: true header.
  • HTML injection in areas requiring unlikely interaction.
  • Exposure of sensitive data on digital archives websites.
  • User email enumeration on sign up, log in, and forgot password pages.
  • Files available in URIs with a path starting with /.well-known (also known as well-known URIs ).
  • 2FA bypass through password reset.
  • User data stored unencrypted
  • Lack of obfuscation
  • Runtime hacking exploits that involve manipulation of running code or its environment
  • CSV injection using Todoist template export feature which could be executed by the application opening the CSV file.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.