Vade

Vulnerability disclosure program on Self-hosted vadesecure.com

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No you hereby (i) acknowledge that you have no expectation of payment and that you expressly waive any future pay claims against Vade related to your submission
Response: Within 3 days Within 3 business days, we will acknowledge that your report has been received.
Safe harbor: Full Vade will not engage in legal action against individuals who voluntary submit vulnerability reports through our Vulnerability Reporting inbox.
Hall of fame: No At this time, Vade does NOT maintain a public facing list of externally reported issues and reporters.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

12 assets you may test, 2 excluded.

Out of scope (2)

What the policy asks of you, and the bug types it won't reward, quoted from Vade's policy. "We" in these lines means the program, not this site.

Perform research only within the “In Scope” set out in this Policy;
Keep information about any vulnerability you’ve discovered confidential between yourself and Vade until we have had at least 90 days to review and resolve the issue.
do not violate any privacy law, (ii) deteriorate in any way the user experience, (iii) disrupt any production systems, or (iv) destroy or manipulate any data during security testing;
Only use exploits to the extent necessary to confirm a vulnerability’s presence.
Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems;
Do not submit a high volume of low-quality reports.
you must stop your test, notify us immediately, and not disclose this data to anyone else.
purge any stored nonpublic data upon reporting a privacy or security vulnerability.
Submit your Reporting Document via PGP encrypted email to [email protected] .

UI and UX bugs and spelling mistakes.
TLS/SSL related issues.
Vulnerabilities due to out-of-date browsers or plugins.
Content-Security Policies (CSP);
Vulnerabilities in end-of-life products.
Vulnerabilities relying on the existence of plugins such as Flash.
Flaws affecting the users of out-of-date browsers and plugins.
Issues that involve a malicious installed application on the device.
Vulnerabilities requiring a jailbroken device.
Vulnerabilities requiring a physical access to mobile devices.
Use of a known-vulnerable library without proof of exploitability; and/or
Tap-jacking and UI-redressing attacks that involve tricking the user into tapping a UI element.
Account lockout or rate limit features.
“Source Code Disclosures” of JavaScript files, unless that file can be proven to be private.
“Cross Domain Referrer Leakage” unless the referrer string contains privileged or private information.
Subdomain takeover attacks without proof.
HTML injection without any security impact.
CSRF attacks without any impact or that do not cross a privilege boundary.
Any third-party information/credential leaks that don’t fall under Vade’s control (e.g Google, Bing, Github, Pastebin etc);
Vulnerabilities that have been recently published (less than 30 days);
Vulnerabilities that have already been reported/fix in progress.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake