Vidio

Bug bounty on security.txt vidio.com

Accepting reports Full safe harbor security.txt mentions bounty

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash: Yes Our rewards are impact-based, meaning we offer higher rewards for vulnerabilities that could expose sensitive user data, while lower or no rewards for vulnerabilities that only allow minor actions, such as defacing a microsite.
Safe harbor: Full Vidio will not take legal action against security researchers who adhere to the Bug Bounty program's rules.
Hall of fame: Yes Dedicated to the ethical hackers who help secure our platform. We recognize researchers whose vulnerability reports have been validated by our team.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

13 assets you may test, 1 excluded.

Out of scope (1)

What the policy asks of you, and the bug types it won't reward, quoted from Vidio's policy. "We" in these lines means the program, not this site.

Only use your own account for security testing, and avoid causing harm to other users or Vidio's system.
Do not disclose security vulnerabilities to the general public without our permission.
Only publish validated, non-duplicate security flaws that have undergone our verification process.
Refrain from exploiting discovered security vulnerabilities for personal or group gain.
Employing automated scanners and tools to discover vulnerabilities? That's a big no-no in this galaxy.
Don't boldly go where no one has gone before by conducting automated or scripted testing on web forms, especially "Contact Us" forms intended for customer communication with our support team.
Feel free to test vulnerabilities in your own or test accounts, but remember: with great power comes great responsibility—don't access others' data.
No targeting our end users, even if you're a Sith Lord. Also, trading pilfered user credentials is a no-go.
Keep your light sabers at bay and avoid initiating any attacks that may interfere with our services (e.g., DDoS/Spam).
Non-technical assaults, such as social engineering, phishing, or gaining unauthorized access to the matrix—err, infrastructure—are strictly off-limits.

Open redirects.
Publicly accessible login panels
Reports that state that software is out of date/vulnerable without a proof of concept.
Host header issues without an accompanying proof-of-concept demonstrating vulnerability.
XSS issues that affect only outdated browsers.
Stack traces that disclose information.
CSV injection.
Missing best practices (we require evidence of a security vulnerability).
Highly speculative reports about theoretical damage.
Self-XSS that can not be used to exploit other users
Vulnerabilities as reported by automated tools without additional analysis as to how they're an issue.
Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated.
Denial of Service Attacks.
Reflected File Download (RFD).
window.opener-related issues.
Physical or social engineering attempts
Content injection issues.
Cross-site Request Forgery (CSRF) with minimal security implications (Logout CSRF, etc.)
Missing autocomplete attributes.
Missing cookie flags on non-security-sensitive cookies.
Issues that require physical access to a victim’s computer.
Missing security headers that do not present an immediate security vulnerability.
Fraud issues.
SSL/TLS scan reports
Banner grabbing issues

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 3 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Valid until 19 Jun 2027

Read the file Among the top 6,000 websites

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake