- Top reward
- $1,337
- Top severity paid
- Critical
- Assets in scope
- 5
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $1,337
- for critical bugs, from $256.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$1,337 from $512 |
| High |
|
$512 from $256 |
- Top reward
-
$1,337
P1 │ $512 - $1337 (+ Swag + cookies*)
- Lowest reward
-
$256
P2 │ $256 - $512 (+ Swag)
- Safe harbor
-
Full
Authorized in view of any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
- Hall of fame
-
Yes
All accepted submissions of P4 and above will receive a mention in our Contributors list below.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
5 assets you may test, 5 excluded.
Domains 2
- volk.is
- volkis.com.au
Wildcard domains 2
- *.volk.is
- *.volkis.com.au
Products and areas 1
- Third party applications/services/platforms used by Volkis
Out of scope (5)
- Actions that violate Australian law
- (Distributed) Denial of Service of any kind
- Physical attacks against Volkis, its employees, or any property belonging to Volkis or its employees
- Social engineering of any kind
- *.volkis.io
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Volkis's policy. "We" in these lines means the program, not this site.
While testing
-
Report any vulnerability you’ve discovered promptly
-
Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience
-
Use only the Official Channels to discuss vulnerability information with us
-
Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope
-
Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept
-
You should only interact with test accounts you own or with explicit permission from the account holder
-
Do not engage in extortion
-
Make sure that you get consent from the third party before attempting to hack them!
Not accepted
-
Missing HTTP headers
-
Out-of-date software/libraries unless you can prove their impact
-
Theoretical SSL/TLS findings
-
“Best practice” configurations that do not have impact
-
“Self” exploits (such as Self-XSS) and exploits that required significant actions from users
-
We will not accept theoretical vulnerabilities such as TLS vulns and missing security headers, unless you can show impact.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.