- Top reward
- $100,000
- Top severity paid
- Critical
- Assets in scope
- 5
- Public CVEs
- 2
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $100,000
- for critical bugs.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$100,000 from $1,000 |
| High |
|
$10,000 from $500 |
| Medium |
|
$5,000 from $250 |
| Low |
|
$2,000 |
- Top reward
-
$100,000
Critical $1 000 – $100 000*
- Safe harbor
-
Partial
Act in good faith to protect user and company data.
- Hall of fame
-
Yes
Name or nickname (optional) – To be included on our list of past issues.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test.
Domains 1
- trezor.io
Hardware and IoT 1
- Trezor devices and firmware
Products and areas 3
- Blockbook and other backend infrastructure
- Trezor Connect
- Trezor Suite app
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Trezor's policy. "We" in these lines means the program, not this site.
While testing
-
Act in good faith to protect user and company data.
-
Give us time to fix the issue before disclosing it publicly.
-
Avoid any fraud or harm during your research.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2020-18172 | A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges. | Critical 9.8 | 26 Jul 2021 |
| CVE-2019-14353 | On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In | Medium 4.2 | 8 Aug 2019 |