NT-ware

Vulnerability disclosure program on security.txt nt-ware.com

Accepting reports security.txt

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No We do not conduct a bug bounty program. Accordingly, please acknowledge that there is no expectation of payment or compensation and that any future right to claim related to the submitted report is waived.
Response: Within 3 days The reporter can expect an acknowledgment of receipt from us within 3 business days after receiving the initial submission.
Safe harbor: Partial Provided you follow the rules and principles below when reporting weaknesses in our IT systems, NT-ware will not report your offense to the authorities and will not submit a claim.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

22 assets you may test.

What the policy asks of you, and the bug types it won't reward, quoted from NT-ware's policy. "We" in these lines means the program, not this site.

Take responsibility and act with extreme caution. When investigating the matter, only use methods or techniques necessary to find or demonstrate weaknesses.
Violate any law or regulations.
Access unnecessary, excessive or significant amounts of data.
Copy more than you need. If one record is sufficient, do not go any further.
Modify data in NT-ware's systems or services.
Use high-intensity invasive or destructive scanning tools to identify vulnerabilities.
Attempt or report any form of denial of service e.g. overwhelming a service with a high volume of requests.
Disrupt or alter NT-ware's services, systems or information.
Demand financial compensation in order to disclose any vulnerabilities.
Publicly disclose any resolved vulnerability report without prior written consent from NT-ware.

Volumetric/ denial of service vulnerabilities i.e. simply overwhelming our service with a high volume of requests.
TLS configuration weaknesses e.g. "weak" cipher suite support, TLS1.0 support, sweet32 etc.
"Self" XSS.
Mixed Content Scripts on www.nt-ware.*
Insecure Cookies on www.nt-ware.*
CSRF and CLRF attacks where the resulting impact is minimal.
HTTP Host Header XSS without working proof-of-concept.
Incomplete/ missing SPF/ DMARC/ DKIM.
Social engineering attacks.
Security bugs in third-party websites that integrate with NT-ware websites.
Network data enumeration techniques e.g. banner grabbing, publicly available server diagnostic pages.
Reports indicating that our services do not fully align with "best practice."
Automated software scanners output.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Valid until 29 Jan 2027

Contact: uniflowonline.com/en/trust-center/security/security-and-vulnerability-disclosure-policy/
Hiring: nt-ware.com/en/jobs-applications/

Read the file Among the top 16,000 websites

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake