Waitwhile
Bug bounty on security.txt waitwhile.com
- Top reward
- $250
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $250
- for critical bugs, from $25.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Paid by PayPal
- No identity requirement stated.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$250 |
| High |
|
$150 |
| Medium |
|
$50 |
| Low |
|
$25 |
- Top reward
-
$250
1. Critical $250
- Lowest reward
-
$25
4. Low $25
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 2 excluded.
Domains 4
- api.waitwhile.com
- app.waitwhile.com
- new.waitwhile.com
- waitwhile.com
Out of scope (2)
- help.waitwhile.com
- third-party applications or services built on the Waitwhile API
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Waitwhile's policy. "We" in these lines means the program, not this site.
While testing
-
Automated testing is not permitted.
-
Test only with your own account(s) when investigating bugs, and do not interact with other accounts without the consent of their owners.
-
You must be the first person to report the issue to us.
-
We award bounties at time of fix, and will keep you posted as we work to resolve them.
-
Report identified bugs to [email protected]
Not accepted
-
Issues found through automated testing
-
"Scanner output" or scanner-generated reports
-
Publicly-released bugs in internet software within 3 days of their disclosure
-
"Advisory" or "Informational" reports that do not include any Waitwhile-specific testing or context
-
Vulnerabilities requiring physical or remote access to the victim's unlocked device
-
Denial of Service attacks
-
Brute Force attacks
-
Spam or Social Engineering techniques
-
SPF and DKIM issues
-
Content injection
-
Hyperlink injection in emails
-
IDN homograph attacks
-
RTL Ambiguity
-
Content Spoofing
-
Issues relating to Password Policy
-
Full-Path Disclosure on any property
-
Version number information disclosure
-
Clickjacking on pre-authenticated pages, or the non-existence of X-Frame-Options, or other non-exploitable clickjacking issues
-
CSRF-able actions that do not require authentication (or a session) to exploit
-
Bugs that do not represent any security risk
-
Security bugs in help.waitwhile.com
-
Security bugs in third-party applications or services built on the Waitwhile API
-
Submissions from former Waitwhile employees within one year of their departure from Waitwhile
-
Reports without written step-by-step instructions will be rejected
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.