Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Tucows (VDP)

By Tucows Vulnerability disclosure program on HackerOne tucows.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
11
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Safe harbor
Full If you follow this policy in good faith, we consider your security research authorized and will not take legal action.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

11 assets you may test, 6 excluded.

Wildcard domains 10

  • *.ascio.com Critical No bounty
  • *.enom.com Critical No bounty
  • *.exacthosting.com Critical No bounty
  • *.hover.com Critical No bounty
  • *.opensrs.com Critical No bounty
  • *.simplybits.com Critical No bounty
  • *.ting.com Critical No bounty
  • *.tingmobile.com Critical No bounty
  • *.tucowsdomains.com Critical No bounty
  • *.wavelo.com Critical No bounty

Web 1

  • https://www.tucows.com Critical No bounty
Out of scope (6)
  • Third Party Credential Listing
  • Third Party Support Sites
  • github.com/tucows
  • partners.wavelo.com
  • *.partners.wavelo.com
  • *.tucows.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Tucows (VDP) (via HackerOne)'s policy.

Not accepted

  • subdomain takeovers
  • directory listings
  • wordpress installs
  • publicly accessible software archives
  • credentials harvested via malware, phishing, or third-party breaches

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 6 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    github.com/tucows (out of scope)

  2. Scope added

    *.partners.wavelo.com (out of scope)

  3. Scope added

    partners.wavelo.com (out of scope)

  4. Scope added

    *.tucows.com (out of scope)

  5. Scope added

    Third Party Credential Listing (out of scope)

  6. Scope added

    Third Party Support Sites (out of scope)

  7. Scope added

    *.ascio.com

  8. Scope added

    *.enom.com

  9. Scope added

    *.exacthosting.com

  10. Scope added

    *.hover.com

  11. Scope added

    *.opensrs.com

  12. Scope added

    *.simplybits.com

  13. Scope added

    *.ting.com

  14. Scope added

    *.tingmobile.com

  15. Scope added

    *.tucowsdomains.com

  16. Scope added

    *.wavelo.com

  17. Scope added

    https://www.tucows.com

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Introduction

Welcome to the Tucows Vulnerability Disclosure Program!

At Tucows we take security seriously. If you believe that you have found a security vulnerability in any of the systems in scope, please report it to us using the "Submit Report" button on this page.

Tucows appreciates your participation in this program and looks forward to your findings.

Disclosure Policy

Please follow HackerOne's Vulnerability Disclosure Guidelines

Unqualified Issues

Please refer to the Core Ineligible Findings for a list of reports we do not accept.

Subdomains under tucows.com (*.tucows.com)

At this point we do not accept reports for subdomains under tucows.com (*.tucows.com). This includes but is not limited to subdomain takeovers, directory listings, wordpress installs, publicly accessible software archives.

Support websites

We do not take reports for our support sites. These websites are hosted by a third party:

  • support.ascio.com
  • support.hover.com
  • support.opensrs.com
  • support.enom.com
  • support.exacthosting.com

Please redirect reports for these sites to the H1 program for the vendor at https://hackerone.com/freshworks

InfoStealer, Third-party breaches, Malware Stealer Credentials

Reports involving credentials harvested via malware, phishing, or third-party breaches are out of scope and not eligible for reward. While these findings are not in scope for this program, we take credential leaks and data exposure seriously. If you do discover such information, please share it with us as informational— it helps inform our internal monitoring and remediation processes.

Safe Harbour

Tucows supports a transparent, respectful, and collaborative approach to vulnerability disclosure. If you follow this policy in good faith, we consider your security research authorized and will not take legal action.

Thank you for helping keep Tucows and our users safe!