Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Zebra VDP

By Zebra Vulnerability disclosure program on HackerOne zebra.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
55
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
Replies within 3 days
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Pays cash
No As a vulnerability-disclosure program, Zebra's VDP does not award bounties, so this affects validation and duplicate handling only.
Response
Within 3 days | First Response | `3 days` |
Safe harbor
Partial Going beyond what is necessary to demonstrate a finding may affect your report's eligibility and may fall outside safe-harbor protections.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

55 assets you may test, 27 excluded.

Web 29

  • api.zillin.io Critical No bounty
  • artifactory-us.zebra.com Critical No bounty
  • deutsch.zebra.com Critical No bounty
  • devicetracker-released-internal-demo.firebaseapp.com Critical No bounty
  • espana.zebra.com Critical No bounty
  • espanol.zebra.com Critical No bounty
  • francais.zebra.com Critical No bounty
  • greece.zebra.com Critical No bounty
  • italiano.zebra.com Critical No bounty
  • japanese.zebra.com Critical No bounty
  • norsk.zebra.com Critical No bounty
  • polski.zebra.com Critical No bounty
  • portal.uvtrace.com Critical No bounty
  • portugal.zebra.com Critical No bounty
  • portugues.zebra.com Critical No bounty
  • psion.com Critical No bounty
  • russian.zebra.com Critical No bounty
  • software.symbol.com Critical No bounty
  • suomi.zebra.com Critical No bounty
  • support.symbol.com Critical No bounty
  • svenska.zebra.com Critical No bounty
  • www.zebracanada.com Critical No bounty
  • www.zebra.co.kr Critical No bounty
  • zebrachina.com.cn Critical No bounty
  • zebradirect.com Critical No bounty
  • zebrakorea.co.kr Critical No bounty
  • zebraprint.com Critical No bounty
  • zebraprinter.co.kr Critical No bounty
  • zebrasoftware.com Critical No bounty

Wildcard domains 26

  • *.antuit.ai Critical No bounty
  • *.bankofamerica.reflexisinc.com Critical No bounty
  • *.cortexica.com Medium No bounty
  • *.cto-si.zebra.com Critical No bounty
  • *.cvsltc.reflexisinc.com Critical No bounty
  • *.dnacloud.zebra.com Critical No bounty
  • *.elotouch.com Critical No bounty
  • *essmartpackd.zebra.engineering Critical No bounty
  • *.hartsystems.com Critical No bounty
  • *.jpmc.reflexisinc.com Critical No bounty
  • *.knlbobs.reflexisinc.com/mywork Critical No bounty
  • *.mcduk.reflexisinc.co.uk Critical No bounty
  • *.pp.zebra.com Critical No bounty
  • *.pttpro.zebra.com Critical No bounty
  • *.reflexisinc.com Critical No bounty
  • *spx-load.zebra.engineering Critical No bounty
  • *.toolsportal.zebra.com Critical No bounty
  • *.viq.zebra.com Critical No bounty
  • *.zams.zebra.com Critical No bounty
  • *.zebra.com Critical No bounty
  • *.zebra.com/mobicontrol Critical No bounty
  • *.zebra.engineering Critical No bounty
  • *.zebrainventory.com Critical No bounty
  • *.zebramwe.com Critical No bounty
  • *.zebrasports.com Critical No bounty
  • *.zpc.zebra.com Critical No bounty
Out of scope (27)
  • cmm01.sl.zebra.com
  • comtecis.com
  • eltron.com
  • eltron.com.cn
  • healthcare.virtualzebra.com
  • healthcare-ws.virtualzebra.com
  • laserband.com
  • laserband.co.uk
  • sellandwinclub.com
  • swecoin.com
  • swecoin.nu
  • swecoin.se
  • swecoinus.com
  • temptimecorp.com
  • truecolours.net
  • vod.zebra.com
  • www.comtecis.com
  • www.matrox.com
  • www.multispectral.com
  • www.wherenet.com
  • www.zebra.cn
  • *.fetchcore-cloud.com
  • *medialibrary.zebra.com
  • *.mobicontrolcloud.com
  • *.profitect.com
  • *.rwsofficedepot.reflexisinc.com
  • *.zebracard.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Zebra VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Include a custom HTTP header in all your traffic.
  • For anything that requires credentials, researchers must use their `@wearehackerone.com` email alias as part of the HackerOne platform.
  • Conduct testing only with your own personal/test accounts or accounts for which you have explicit, written permission from the account holder.
  • Be careful during testing to prevent any negative impact on customers and their services.
  • For SQL Injection (SQLi), use safe methods like a sleep command to demonstrate vulnerabilities without unauthorized data access or modification.
  • Use commands like `‘whoami’` to demonstrate RCE without further actions.
  • Do not alter or delete files on the system.
  • Social engineering (e.g., phishing, vishing, smishing) is strictly prohibited.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.

Not accepted

  • Subdomain takeovers, dangling DNS records, or unclaimed cloud resources.
  • Credential stuffing, credential reuse, or compromised credentials from third-party breaches
  • Account takeovers resulting from credentials exposed in external data breaches or third-party email compromises
  • Clickjacking on pages with no sensitive actions.
  • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
  • Attacks requiring MITM or physical access to a user's device.
  • Previously known vulnerable libraries without a working Proof of Concept.
  • Reports based solely on historical data (e.g., archive.md, Wayback Machine).
  • Reports based solely on DNS records without a working PoC.
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability.
  • Missing best practices in SSL/TLS configuration.
  • Any activity that could lead to the disruption of our service (DoS).
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
  • Rate limiting or bruteforce issues on all endpoints.
  • Missing best practices in Content Security Policy.
  • Missing HttpOnly or Secure flags on cookies.
  • Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.).
  • Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version].
  • Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
  • Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be assessed on a case-by-case basis.
  • Tabnabbing.
  • Open redirect - unless an additional security impact can be demonstrated.
  • Issues that require unlikely user interaction.
  • Other publicly known vulnerabilities or theoretical vulnerabilities.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 18 minutes ago.

  1. Scope +

    Added to scope: vod.zebra.com

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    vod.zebra.com (out of scope)

  2. Rules updated

    Added: “| `PPME help docs (LB default route)` | `spg-zpc-p-ppme-help-docs` | `spg-zpc-s-ppme-help-docs` | `spg-zpc-d-ppme-help-docs` |”

  3. Rules updated

    Added: “==Additional out-of-scope public assets (public by design):== The following static sites (served out of GCS buckets behind a load balancer) and GCS buckets are...”

  4. Rules updated

    Added: “Limit Access to What Proves the Finding:** When a vulnerability gives you access to data, an account, or a system, stop as soon as you have enough to demonstrat...”

  5. Rules updated

    The program rules were edited

  6. Rules updated

    Added: “==Additional out-of-scope public assets (public by design):== The following static sites (served out of GCS buckets behind a load balancer) and GCS buckets are...”

  7. Rules updated

    Added: “==**Additional out-of-scope public assets (public by design):**== The following static sites (served out of GCS buckets behind a load balancer) and GCS buckets...”

  8. Rules updated

    The program rules were edited

  9. Rules updated

    Added: “Additional out-of-scope public assets (public by design):** The following static sites (served out of GCS buckets behind a load balancer) and GCS buckets are in...”

  10. Rules updated

    The program rules were edited

  11. Scope added

    *.knlbobs.reflexisinc.com/mywork

  12. Scope added

    *.zebra.com/mobicontrol

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Overview:

At Zebra, we are committed to collaborating with the security community to identify and address vulnerabilities. Our goal is to safeguard our businesses and ensure the safety of our customers.

Scope:

Everything Zebra-owned or controlled is in scope unless otherwise stated in the asset list.

Production and Non-Production Environments:

Production Environment: This environment consists of all live systems and services actively used by Zebra’s customers. Testing in this environment should be conducted with extreme caution to avoid any impact on our users. Non-Production Environment: This environment includes all systems and services used for development, testing, and staging purposes. Researchers are strongly encouraged to conduct tests here whenever possible to prevent disruptions to live services.

Response Targets:

Zebra will work to meet the following SLAs for ethical hackers (“Researchers”) participating in our program:

Type of Response SLA in business days
First Response 3 days
Time to Triage 3 days
Time to Resolution depends on severity and complexity

We’ll try to keep you informed about our progress throughout the process!

Disclosure Policy:

  • As this is a private program, please do not discuss this program or any bugs or vulnerabilities (even resolved ones) outside of the program without express, written consent from Zebra.
  • Always follow HackerOne’s disclosure guidelines.

Program Rules:

Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for validation.

  • Try to provide a remediation; it helps the development team to know the fix from Researchers’s point of view.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only validate the first report that was received that can be fully reproduced.
  • Multiple vulnerabilities caused by one underlying issue will be validated once even if multiple endpoints are affected by the one underlying issue.
  • Social engineering (e.g., phishing, vishing, smishing) is strictly prohibited.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit, written permission of the account holder.
  • Limit Access to What Proves the Finding: When a vulnerability gives you access to data, an account, or a system, stop as soon as you have enough to demonstrate the issue. Do not access, copy, download, modify, or exfiltrate data beyond the minimum needed to prove impact; do not pivot to other systems or accounts; and do not establish or maintain persistent access. Capture only the evidence required for your report (for example, a limited screenshot or a single record) and report it promptly. Going beyond what is necessary to demonstrate a finding may affect your report's eligibility and may fall outside safe-harbor protections.

  1. HTTP Headers:

    • Include a custom HTTP header in all your traffic. Burp and other proxies allow the easy automatic addition of headers to all outbound requests.
    • Identifier: Your Username
    • Format: X-Bug-Bounty:HackerOne-<username>
    • Example: X-Bug-Bounty: HackerOne-flyingtoasters
    • Identifier: Tool Identifier
    • Format: X-Bug-Bounty:<toolname>
    • Example: X-Bug-Bounty: BurpSuitePro

  2. Email Alias:

  • For anything that requires credentials, researchers must use their @wearehackerone.com email alias as part of the HackerOne platform.

Rules of Engagement:

To ensure the stability of our systems for Zebra, our customers, and fellow ethical Researchers, please follow these guidelines:

  1. Account Usage:
  • Conduct testing only with your own personal/test accounts or accounts for which you have explicit, written permission from the account holder.
  • Include your @wearehackerone.com email address in reports for verification.
  1. Testing Caution:
  • Be careful during testing to prevent any negative impact on customers and their services.
  • If unsure or if you suspect potential harm, stop immediately, report your findings, and seek authorization before continuing.
  1. Demonstrating Vulnerabilities:
  • For SQL Injection (SQLi), use safe methods like a sleep command to demonstrate vulnerabilities without unauthorized data access or modification.
  1. Access Control Vulnerabilities:
  • If you report an access control vulnerability, subsequent reports exploiting the same flaw will be treated as duplicates.
  • This policy applies globally to all domains and subdomains under our program. Once an access control issue is reported, similar root cause findings will follow this policy.
  • Once the root cause is resolved, new, distinct vulnerabilities will be assessed independently.
  • We will maintain open communication with researchers, ensuring clarity in classification and validation decisions.
  1. ==Shared-Codebase and Multi-Tenant Platforms (e.g., Reflexis):==
  • Some Zebra applications are deployed as a single shared codebase across many customer-tenant instances (for example, the Reflexis workforce-management platform, which is deployed per customer across subdomains under *.reflexisinc.com). Because these tenant instances run the same underlying code, a vulnerability found on one tenant is typically present on the others, and a single fix to the shared platform remediates all of them.
  • The same vulnerability or root cause reported across multiple tenant instances of one shared-codebase platform will be treated as a single finding. Consistent with the one-underlying-issue rule above, only the first report received that can be fully reproduced is validated, regardless of how many tenant hosts are affected. As a vulnerability-disclosure program, Zebra's VDP does not award bounties, so this affects validation and duplicate handling only.
  • This does not apply to genuinely tenant-specific issues. A finding that arises from a single tenant's own configuration, data, or credentials (for example, a default or rotated credential specific to one environment, a misconfiguration unique to one tenant, or data exposure particular to one customer instance) is assessed as a distinct finding on its own merits.
  • Once the shared root cause is remediated across the platform, new and distinct vulnerabilities are assessed independently.
  • This guidance applies to reports submitted on or after the date it is published to this policy. Reports submitted before that date are assessed under prior practice.
  1. Remote Code Execution (RCE):
  • Use commands like ‘whoami’ to demonstrate RCE without further actions.
  • Do not alter or delete files on the system.
  • For root permissions, use the following commands in a vulnerable process:
    • Read: cat /proc/1/maps
    • Write: touch /root/<your H1 username>
    • Execute: id, hostname, password (also cat and touch for execution proof)

  1. ==Credential Leaks and Password Exposures:==

    • We primarily accept reports of credentials directly exposed through Zebra-owned systems (e.g., hardcoded in source code, exposed in configuration files, visible in API responses, exposed in logs).
    • Credentials obtained from third-party breaches, public data dumps, credential stuffing attacks, or password reuse from external sources are generally OUT OF SCOPE (see the case-by-case exception below).
    • On a case-by-case basis, we may accept credentials sourced from a third-party or external breach (including public data dumps) only when all of the following are true: (a) the exposed credential belongs to a Zebra-owned, Zebra-issued, or Zebra-managed account (for example, a Zebra corporate/employee account, a Zebra directory/Active Directory account, or a Zebra service account), not an individual's personal account or a non-Zebra third-party account; (b) the reporter demonstrates the credential is still valid against a Zebra-owned system; and (c) the exposure has not already been identified or remediated by Zebra. These reports give us valuable early insight when our own monitoring has not yet detected a leaked Zebra account credential. Submit the report with evidence of current validity, and Zebra will assess scope individually. Reports where an external individual's own personal or third-party credentials are reused to log into a Zebra-hosted, SSO-federated, or customer/partner-facing application are credential reuse and remain out of scope (see Out-Of-Scope Vulnerabilities), even when the target host is under *.zebra.com.
    • Include details about where the credentials were found (within Zebra infrastructure or in an external breach/dump), their format, and how they were exposed.

  2. ==Severity Guidance - Cross-Site Scripting (XSS):==

    • Cross-Site Scripting (XSS) reports are classified at Medium severity as the program's standard classification, regardless of the specific affected environment or domain. Reports assessed higher or lower on intake are normalized to Medium. As a vulnerability-disclosure program, Zebra's VDP does not award bounties, so this guidance affects severity classification and validation only.
    • Exception (HTML injection in web forms, classified Low): Reports where input submitted through a web form (for example a contact, feedback, support, or marketing form) is rendered without encoding when the submission is later viewed, and the demonstrated impact is limited to HTML injection or a forced redirect (for example an injected "><meta http-equiv="refresh"> tag), without demonstrated JavaScript/script execution and without a demonstrated sensitive impact (such as session, credential, or data theft), are classified as Low severity. This applies regardless of how the report is titled or submitted (for example "Basic XSS"), because the demonstrated impact is content injection rather than cross-site scripting.
    • If the reporter demonstrates actual JavaScript/script execution, or a concrete sensitive impact (such as account or session takeover, credential theft, or access to sensitive data), the standard Medium XSS classification applies (the Low exception does not).
    • Speculative impact (for example "could allow...") is not treated as demonstrated impact.
    • This guidance applies to reports submitted on or after the date it is published to this policy. Reports submitted before that date are assessed under prior practice.

  3. ==Out-Of-Scope Vulnerabilities:==

    • Subdomain takeovers, dangling DNS records, or unclaimed cloud resources.
    • Credential stuffing, credential reuse, or compromised credentials from third-party breaches, including cases where an external individual's own personal or third-party account credentials authenticate to a Zebra-hosted, SSO-federated, or customer/partner-facing application under *.zebra.com. The only exception is a leaked Zebra-owned or Zebra-managed account credential that meets all conditions in Credential Leaks and Password Exposures above.
    • Account takeovers resulting from credentials exposed in external data breaches or third-party email compromises, where the compromised account is an individual's own external/personal account rather than a Zebra-owned account.
    • Clickjacking on pages with no sensitive actions.
    • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
    • Attacks requiring MITM or physical access to a user's device.
    • Previously known vulnerable libraries without a working Proof of Concept.
    • Reports based solely on historical data (e.g., archive.md, Wayback Machine).
    • Reports based solely on DNS records without a working PoC.
    • Comma Separated Values (CSV) injection without demonstrating a vulnerability.
    • Missing best practices in SSL/TLS configuration.
    • Any activity that could lead to the disruption of our service (DoS).
    • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
    • Rate limiting or bruteforce issues on all endpoints.
    • Missing best practices in Content Security Policy.
    • Missing HttpOnly or Secure flags on cookies.
    • Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.).
    • Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version].
    • Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
    • Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be assessed on a case-by-case basis.
    • Tabnabbing.
    • Open redirect - unless an additional security impact can be demonstrated.
    • Issues that require unlikely user interaction.
    • Other publicly known vulnerabilities or theoretical vulnerabilities.

  4. ==Out-Of-Scope Domains:==

    • *.profitect.com - A legacy application that is currently being depreciated. As customers transition to a new version, the remediation team will no longer actively develop or make changes to this platform.
    • *.rws.reflexisinc.com - These are legacy applications that the team is no longer going to support in the future. Any reported vulnerabilities related to any domain with the rws domain will automatically close out as "Informational."
    • *.mobicontrolcloud.com - Zebra does not own or maintain control over most subdomains and DNS records under this wildcard. Reports targeting these assets, including subdomain takeovers and DNS-related issues, will automatically close out as "Informational." Any existing reports in triage will be closed accordingly.

==Additional out-of-scope public assets (public by design):== The following static sites (served out of GCS buckets behind a load balancer) and GCS buckets are intentionally public. Reports targeting them are out of scope and will be closed as "Informational."

Static websites behind a load balancer (intended public):

Hostname Prod (spg-zpc-p) Stage (spg-zpc-s) Dev (spg-zpc-d)
nucleus[-stage/-dev].zebra.com spg-zpc-p-harmonix-webui spg-zpc-s-harmonix-webui spg-zpc-d-harmonix-webui
zsbportal[-stage/-dev].zebra.com spg-zpc-p-zsbportal-webui spg-zpc-s-zsbportal-webui spg-zpc-d-zsbportal-webui
demo.zpc[-stage/-dev].zebra.com spg-zpc-p-static-web spg-zpc-s-static-web spg-zpc-d-static-web
asr.zpc[-stage/-dev].zebra.com ats-zpc-p-scw ats-zpc-s-scw ats-zpc-d-scw
PPME help docs (LB default route) spg-zpc-p-ppme-help-docs spg-zpc-s-ppme-help-docs spg-zpc-d-ppme-help-docs

Public GCS buckets:

Bucket Project Contents
spg-zpc-p-scannersetup, -s-, -d- p/s/d Scanner setup PDFs (website config set)
spg-zpc-p-printer-tools p ZSB Printer Tools installers (.dmg/.exe)
spg-zpc-s-printer-tools s Same installers; 16 of 27 objects are public through object ACLs
spg-zpc-adc-recipes, spg-zpc-adc-recipes-dev p / d Scanner recipe JSON
spg-zpc-ats-recipes, spg-zpc-ats-recipes-dev p / d Recipes
spg-zpc-ats-printer-models, -dev p / d Printer model images
plugin-public-access d Scanner plug-ins (.SCNPLG)
spg-zpc-s-rss, spg-zpc-d-rss s / d index.xml feed
spg-zpc-p-envirovue-certs, -s-, -d- p/s/d EnviroVue calibration/conformance certificate PDFs

Reporting Guidelines:

When submitting a report, please consider including the following information to help us effectively validate and address the issue:

  1. Testing Environment:
  • Specify the environment you used for testing, including details such as browsers, app versions, devices, tools, and configuration settings.
  1. Accounts Used:
  • List any accounts you utilized during the testing process. This helps us determine potentially nefarious accounts.
  1. Public-Facing IP Address:
  • Provide your public-facing IP address if you’re reporting on an asset that might log this information. This helps us filter your activity and validate your findings more efficiently.

By participating in Zebra’s HackerOne program you agree to adhere to the above terms and any deviation may impact the potential validation or ability to make future submissions.