Webnode

Bug bounty on security.txt webnode.com

Accepting reports Full safe harbor security.txt

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash: Yes Any rewards are provided solely within our program on the Intigriti platform, at our discretion and subject to the program's current capacity.
Safe harbor: Full If you conduct your research in good faith and comply with this policy, we will consider your research authorized, will not treat it as unauthorized access, and will not pursue legal action against you.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

18 assets you may test, 2 excluded.

Out of scope (2)

What the policy asks of you, and the bug types it won't reward, quoted from Webnode's policy. "We" in these lines means the program, not this site.

Test only against your own accounts and projects; do not access other users' data.
Limit data access to the minimum necessary to demonstrate the vulnerability; do not exfiltrate, modify, or delete data.
Do not disrupt our services — no DoS/DDoS and no automated brute-force attacks.
No social engineering, phishing, or physical attacks against employees or customers.
Do not publicly disclose the vulnerability until it has been resolved, or until we agree on coordinated disclosure.
Allow us reasonable time to remediate.

Username/email enumeration; WordPress username disclosure.
Missing or bypassable rate limiting; email bombing.
Missing security headers; missing cookie flags; presence of the autocomplete attribute on forms.
CSRF with low or no impact; clickjacking without realistic user interaction.
Self-XSS not exploitable against other users; same-site scripting; content injection without the ability to modify HTML.
CORS misconfiguration on non-sensitive endpoints.
Anything related to email spoofing, SPF, DMARC, or DKIM.
API key / version / banner disclosure without business impact; un-stripped file metadata.
Blind SSRF without demonstrated impact (pingbacks alone are not sufficient); host header injection without impact.
Pre-auth account takeover / OAuth squatting; race conditions; HTTP request smuggling without demonstrated impact.
Best-practice recommendations (password policy, expiration, reuse, etc.).
Reports that software is outdated or vulnerable without a proof of concept; theoretical issues without a realistic exploit scenario.
DoS/DDoS and brute-force attacks; spam; social engineering; physical attacks.
Attacks requiring physical access to a device, MITM, or a compromised account.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 2 hours ago.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Valid until 31 Mar 2027

Read the file Among the top 7,000 websites

Same policy on 11 more domains

webnode.page, webnode.cz, webnode.es, webnode.fr, webnode.jp, webnode.it, webnode.sk, webnode.hu, webnode.ru, webnode.pt, webnode.nl

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake