Vivid

By Vivid Money Bug bounty on Self-hosted vivid.money

Accepting reports Full safe harbor KYC to get paid

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash: Yes The reward is paid only for the discovery of previously unknown vulnerabilities.
Response: Within 14 days On average, each report is reviewed within TWO WEEKS .

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

11 assets you may test.

https://play.google.com/store/apps/details?id=vivid.money
Mobile Application Android: https://play.google.com/store/apps/details?id=vivid.money

What the policy asks of you, and the bug types it won't reward, quoted from Vivid's policy.

For testing should use only your own accounts.
You are allowed to use the credentials of other users for testing, provided that they have explicitly agreed to provide the credentials.
Vivid Money does not issue additional accesses and accounts (including test accounts) for testing.
Any attempts to access other people's credentials of users of Vivid Money applications and services are prohibited.
When searching for vulnerabilities, it is prohibited to violate the integrity, availability and confidentiality conditions for Vivid Money applications and services.
Any activity that could damage the company's applications, infrastructure, customers and partners is prohibited.
To confirm the presence of vulnerabilities should be used minimally adequate set of checks.
During RCE testing, any actions on the server are prohibited except: Execution of commands ifconfig (ipconfig), hostname, whoami.
Read, change, modify, delete and replace any files on the server (including system files).
Without the written consent of Vivid Money, researchers are prohibited from disclosing discovered vulnerabilities

Spam.
Vulnerabilities that require social engineering/phishing.
Reports of phishing and other social engineering techniques.
DDOS attacks.
Hypothetical issues that do not have any practical impact.
Security vulnerabilities in third-party applications/libraries and on third-party websites integrated with Vivid Money.
Scanner output or scanner-generated reports.
Issues found through automated testing.
Publicly-released bugs in Internet software within 30 days of their disclosure.
Man-in-the-Middle attacks.
Host header injections without a specific, demonstrable impact.
Self-XSS without the ability to attack other users.
Login/logout CSRF.
CSRF and XSS without influencing sensitive data.
Bypass checking for root and jailbreak.
Messages about the possibility of mobile application reverse engineering.
Information about IP addresses, DNS records and open ports.
Disclosure of public information about users.
Clickjacking.
Messages about disadvantages of using SMS codes.
The ability to unlimited sending SMS and Email.
Open Redirect without an additional attack vector (for example, token theft authorization).
Content Substitution on page.
Tabnabbing.
Full Path Disclosure.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake