- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
This is **not a public bug bounty program**. We do **not** guarantee monetary rewards for vulnerability reports.
- Response
-
Within 2 days
| Acknowledgment of receipt | 2 business days | 5 business days | 10 business days | 10 business days |
- Safe harbor
-
Full
We support responsible security research and will not pursue legal action against individuals who:
- Hall of fame
-
Yes
We may publicly acknowledge researchers who responsibly disclose valid vulnerabilities, unless anonymity is requested.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 5 excluded.
Domains 2
- vtex.com
- vtex.com and related domains
Out of scope (5)
- Absence of rate limiting without demonstrated exploitation impact
- Individual merchant stores built on the VTEX platform
- Missing security headers without demonstrated impact
- Theoretical vulnerabilities without proof of exploitability
- Third-party integrations or services outside VTEX's control
Rules
What the policy asks of you, and the bug types it won't reward, quoted from VTEX's policy. "We" in these lines means the program, not this site.
While testing
-
Test only against accounts and assets you own or have been explicitly authorized to use — do not use accounts belonging to other merchants, customers, or employees
-
Stop testing immediately if you encounter sensitive data and report it to us
-
Access, modify, or exfiltrate data belonging to customers, employees, or third parties
-
Perform denial-of-service (DoS/DDoS) or resource exhaustion attacks
-
Conduct automated or high-volume scanning that impacts service stability
-
Attempt social engineering, phishing, or physical attacks
-
Exploit vulnerabilities beyond what is strictly necessary to demonstrate their existence
-
Do not include sensitive customer data in your report.
-
You are responsible for manually validating any content generated by AI tools or automated scanners before submission.
Not accepted
-
Missing security headers (CSP, X-Frame-Options, etc.) without demonstrated impact
-
DNS or email configuration findings (CAA records, MTA-STS, DMARC, SPF, DKIM) without demonstrated exploitation impact
-
Self-XSS or issues requiring full control of the victim's browser or account
-
Publicly accessible CMS maintenance endpoints without demonstrated resource exhaustion impact
-
Rate limiting absence without demonstrated exploitation impact
-
Automated scanner output without manual validation and PoC
-
Vulnerabilities in third-party services outside our control
-
Social engineering or phishing simulations
-
Theoretical vulnerabilities without proof of exploitability
-
CVSS score inflation without supporting evidence
-
Merchant store misconfigurations that are the responsibility of the merchant to address
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.