Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Wagwalking

By Wag! Bug bounty on Self-hosted wagwalking.com

Accepting reports Full safe harbor
Go to program Website
Top reward
$50,000
Top severity paid
Critical
Assets in scope
8
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $50,000
for critical bugs.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 3 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

Severity Reward
Critical $50,000
High $20,000
Medium $6,000
Low $3,000 from $250
Top reward
$50,000 Critical │ RCE, command injection │ 50,000
Response
Within 3 days We'll confirm receipt of your submission within 72 hours.
Safe harbor
Full We won't pursue or support legal action against researchers acting in good faith under this policy.
Hall of fame
Yes First valid reporter of a finding that triggers a code or config change earns a spot in our Hall of Fame .

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

8 assets you may test, 7 excluded.

Domains 3

  • compare.wagwalking.com
  • pets.wagwalking.com
  • wagwalking.com

Android apps 2

  • Wag! app (iOS/Android)
  • Wag! Walker app (iOS/Android)

iOS apps 2

  • Wag! app (iOS/Android)
  • Wag! Walker app (iOS/Android)

Wildcard domains 1

  • prod-*-api.wagwalking.com
Out of scope (7)
  • Attacks requiring physical device access
  • Findings affecting only third-party services outside Wag!'s control
  • Network-level DoS / DDoS
  • Physical security testing (office access, tailgating, hardware attacks).
  • Social engineering, phishing, or vishing of any Wag! person or user.
  • Systems not listed in the scope above
  • UI/UX bugs and spelling mistakes

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Wagwalking's policy. "We" in these lines means the program, not this site.

While testing

  • Don't compromise user privacy, degrade the service, disrupt production, or alter/destroy data.
  • Stay within the in-scope assets below. If you're unsure, email us before testing.
  • Keep findings confidential during the 90-day embargo period (or until we confirm the fix, whichever is sooner).
  • Use only test accounts you own. If you accidentally encounter real user data, stop and disclose that in your report.
  • Don't submit raw automated scanner output without manual validation.
  • Don't book walks, use promo codes, or interact with real users or walkers as part of testing.
  • Don't perform social engineering, phishing, or vishing of Wag! employees, contractors, or users.
  • Don't share PoC material publicly until coordinated disclosure is complete.

Not accepted

  • Password/account recovery policies
  • Missing SPF, DMARC, or DKIM records
  • Spam reports
  • Vulnerabilities only affecting outdated browsers or OS versions
  • Clickjacking on static or public pages
  • Missing security headers (CSP, X-Frame-Options, etc.)
  • Descriptive error messages or stack traces
  • HTTP 404s, banner disclosure, robots.txt
  • CSRF on unauthenticated forms
  • Autocomplete / save-password browser behaviour
  • Missing Secure or HttpOnly flags on non-session cookies
  • Weak or missing CAPTCHA
  • Username enumeration via login or password reset
  • OPTIONS / TRACE HTTP methods enabled
  • Deprecated TLS versions (1.0/1.1) without demonstrated impact
  • Missing X-Content-Type-Options header
  • Self-XSS
  • CSV / formula injection in data exports (no RCE on Wag! systems)
  • Missing security.txt
  • Rate limiting on non-sensitive, public endpoints
  • Missing SameSite cookie attribute without demonstrated impact
  • Host header injection without a demonstrated exploit (SSRF, cache poisoning, etc.)
  • Open redirect without a demonstrated exploit chain
  • Missing DNSSEC

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.