- Top reward
- $500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $500
- for critical bugs, from $50.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$500 |
| High |
|
$300 |
| Medium |
|
$100 |
| Low |
|
$50 |
- Top reward
-
$500
Critical (P1) │ 9.0 – 10.0 │ Up to $500
- Lowest reward
-
$50
Low (P4) │ 0.1 – 3.9 │ Up to $50
- Response
-
Within 5 days
Once we receive your report, you can expect a first response within 5 business days of submission.
- Safe harbor
-
Full
Authorized under the Computer Fraud and Abuse Act (CFAA) and equivalent state laws — we will not pursue or support legal action for accidental, good-faith violations of this policy;
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 5 excluded.
Android apps 7
- The Wallbox Android app
- The Wallbox Android app (latest released version only)
- The Wallbox Android app, latest released version only
- The Wallbox iOS app (latest released version only)
- The Wallbox iOS app, latest released version only
- Wallbox Android app, latest released version
- Wallbox iOS app, latest released version
Domains 2
- wall-box.com
- wallbox.com
Wildcard domains 2
- *.wall-box.com
- *.wallbox.com
iOS apps 1
- The Wallbox iOS app
Out of scope (5)
- support.wallbox.com
- Charger firmware and onboard software
- charger hardware
- Internal and development services
- Our billing system
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Wallbox's policy. "We" in these lines means the program, not this site.
While testing
-
Never impact customer data or service availability.
-
Stop at proof, don't go further.
-
Don't chain beyond what you found.
-
No social engineering, phishing, or physical testing.
-
No automated scanners.
-
Never make this a negotiation.
Not accepted
-
Clickjacking, and issues that are only exploitable through clickjacking.
-
CSRF on forms available to anonymous users, CSRF that requires knowledge of the token itself, or logout CSRF.
-
Username/email enumeration, or disclosure of non-sensitive identifiers (issue keys, project keys, commit hashes).
-
Descriptive error messages, stack traces, banner/version fingerprinting, or HTTP 404s and other non-200 responses.
-
Rate limiting gaps on login/password-reset forms, weak CAPTCHAs, or lack of account lockout.
-
SSL/TLS configuration findings (cipher suites, forward secrecy, BEAST/BREACH-class issues), or issues limited to browsers we no longer support.
-
Reports that a dependency is outdated, without a demonstrated, working exploit against our use of it.
-
Content spoofing, autocomplete/save-password prompts, or email bombing/flooding.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.