UXCam

Bug bounty on security.txt uxcam.com

Accepting reports Full safe harbor security.txt mentions bounty

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

Top reward: $1,000 Maximum reward $1000
Lowest reward: $50 Minimum reward $50
Response: Within 5 days Allow us to respond to you within 5 business days with our evaluation of your report and the expected resolution date.
Safe harbor: Full We will not take any legal action against you if you play by the rules.
Hall of fame: Yes To be eligible for the Hall of Fame , researchers must submit report for valid and impactful vulnerabilities.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

13 assets you may test, 12 excluded.

Out of scope (12)

What the policy asks of you, and the bug types it won't reward, quoted from UXCam's policy. "We" in these lines means the program, not this site.

Do not attempt to access or modify another user’s data or account. For any cross-account testing, use only your own test accounts.
Avoid actions that may impact service integrity, availability, or confidentiality. Prohibited actions include DDoS, spam, or other disruptive testing.
Testing must not affect real users or lead to unauthorized data changes or service interruptions.
Test only on targets explicitly listed in the program scope, and ensure you are interacting only with assets owned and operated by UXCam.
Automated tools may be used if rate-limited to a maximum of 5 requests per second ; excessive traffic may result in IP or account bans.
Do not attempt any social engineering attacks, including phishing or pretexting against UXCam employees or users.
If you accidentally access or believe that you have accessed sensitive data of customers, employees, or of UXCam, stop testing immediately, securely delete the data, and report it promptly to us.
Do not share, disclose, or discuss any vulnerabilities outside of UXCam’s security team or the program’s submission process.
Name field: Add this string to your name/organization name: BugBounty-
Please include the following header in all server requests; this allows us to identify researcher testing activity and avoids blocking: X-User-Id: <email_you_used_for_bugbounty_signup>

All P5 vulnerabilities corresponding to Bugcrowd's VRT .
Any findings related to data breaches which are within the public domain.
Banner disclosures on common/public services.
Missing best practices (e.g. Content Security Policy, Anti-MIME-Sniffing headers).
TLS/SSL-related concerns (e.g. forward secrecy, insecure cipher suites) without proof of exploitability.
OPTIONS / TRACE HTTP methods enabled.
Email spoofing due to misconfigured SPF/DKIM/DMARC records.
Spam-related reports (SMS, email, etc.).
Username/email enumeration via Login/Forgot Password page error messages.
Lack of rate limiting or brute force issues.
Weak CAPTCHA / CAPTCHA bypass issues.
Logout Cross-Site Request Forgery (logout CSRF).
Clickjacking/tapjacking without significant security impact.
Missing HTTP security headers.
CSRF on non-sensitive forms accessible to anonymous users (e.g. the demo request form).
Known vulnerabilities in libraries or out-of-date software without known exploits.
Vulnerabilities limited to unsupported browsers.
Reports directly from automated tools or scans without a manual PoC.
Denial of Service (DoS/DDoS) attacks.
Files without sensitive information.
Cross-Site Request Forgery (CSRF).
SDK occlusion/masking or opt-out/consent gaps that don't expose data to an unauthorized party.
Privacy or regulatory-compliance concerns (e.g. GDPR) without a demonstrated security vulnerability.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 3 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Valid until 24 Mar 2027

Read the file Among the top 13,000 websites

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake