- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report as the policy says
- The policy page explains how.
- No safe harbor
- No promise about legal action.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 7 days
Within seven business days of initial contact by the Reporter, Zimbra should promptly acknowledge, with a personal response rather than an automated message, that it has received the report.
- Hall of fame
-
Yes
Zimbra will publicly acknowledge the Reporter - if the Reporter approves of Acknowledgement - within 30 days after the release of an Release or Patch that addresses the problem, through the Security Center .
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
1 asset you may test.
Domains 1
- zimbra.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Zimbra's policy.
While testing
-
Reporter must notify only Zimbra or a responsible Coordinator, such as CERT, of the vulnerability.
-
The Reporter must act to protect the information from leaking to external parties between the time of reporting it to the Vendor and final public release.
-
Reporter must agree to hold all vulnerability details private until at least 30 days after a patch or release that fixes the issue has been made generally available (“GA”) for the product.
-
Upon 30 days after a patch or release is released, the Reporter may choose to publish detailed information, but may not publish an exploit under any circumstances.
-
When reporting a security vulnerability to Zimbra, the Reporter should provide, via encrypted communication, all technical information and related materials the Vendor would need to reproduce the issue.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.