- Top reward
- $3,000
- Top severity paid
- Critical
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $3,000
- for critical bugs, from $50.
- Report by email
- [email protected]
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$3,000 from $1,000 |
| High |
|
$1,000 from $500 |
| Medium |
|
$500 from $250 |
| Low |
|
$250 from $50 |
- Top reward
-
$3,000
Critical │ 1000$ – 3000$
- Lowest reward
-
$50
The Bounty Reward will be between $50 to $3000
- Hall of fame
-
Yes
Thanks to the following researchers for reporting important security issues:
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test, 1 excluded.
Domains 1
- walkme.com
Out of scope (1)
- WalkMe’s production environment
Rules
What the policy asks of you, and the bug types it won't reward, quoted from WalkMe's policy. "We" in these lines means the program, not this site.
While testing
-
You will not perform any testing on WalkMe’s production environment.
-
You will perform the testing only on the platform WalkMe provides you and only within the timeframe set by WalkMe for this purpose.
-
You may not disclose any of the testing performed and/or findings of the security vulnerability to any third party, whether you are rewarded for them or not.
-
You may never store any WalkMe data you retrieve during the testing.
-
You may submit up to three (3) security vulnerability issues at a time, so we can address them efficiently and effectively.
-
You must perform the testing yourself, and not farm or subcontract your work out to anyone else.
Not accepted
-
Open redirects (through headers and parameters) / Lack of security speed bump when leaving the site.
-
Text injection.
-
Email spoofing (including SPF, DKIM, from spoofing, and visually similar, and related issues).
-
Clickjacking and issues only exploitable through clickjacking.
-
Lack of Secure and HTTP only cookie flags (critical systems may still be in scope).
-
Login or Forgot Password page brute force, account lockout not enforced, or insufficient password strength requirements.
-
Username / email enumeration by brute forcing / error messages (e.g. login / signup / forgotten password).
-
No Captcha or rate limit on Login Page.
-
Denial of Service attacks.
-
Misconfigured DNS issues.
-
Vulnerable versions of third-party libraries (High severity vulnerabilities with a working Proof-of-Concept may still be accepted).
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.