- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 0
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report as the policy says
- The policy page explains how.
- Partial safe harbor
- Some legal protection; read the terms.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
If your vulnerability report affects a product or service within scope, you may receive a bounty award.
- Safe harbor
-
Partial
Zscaler will not seek judicial or law enforcement remedies against you for identifying security issues as long as you (1) comply with the policies set forth herein; (2) comply with Bugcrowd’s Standard Disclosure Terms ; (3) do not compromise the safety or privacy of our users; (4) do not destroy any
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
0 assets you may test, 7 excluded.
Self-hosted does not list the scope of this program publicly. Check its policy.
Out of scope (7)
- Any attack or vulnerability that hinges on a user’s computer first being compromised
- Denial of service (DoS)—through network traffic, resources exhaustion, or other methods
- Disclosure of known public files and other information disclosures that aren’t a material risk (e.g., robots.txt)
- Issues only present in old browsers/plugins or end-of-life software browsers
- Phishing or social engineering of Zscaler employees, users, or clients
- Systems or issues that relate to third-party technology used by Zscaler
- User enumeration
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Zscaler's policy. "We" in these lines means the program, not this site.
While testing
-
We ask that you keep such reports private until we’ve resolved the issue.
-
You’re expected to engage in security research responsibly.
-
if you discover a publicly exposed password or key, you shouldn’t use it to test the extent of access it grants or to download or exfiltrate data to prove it’s active.
-
if you discover a successful SQL injection, you’re expected not to exploit the vulnerability beyond any initial steps needed to demonstrate your proof of concept.
-
Excessive exfiltration or downloading of Zscaler data, or demanding payment in return for destruction of Zscaler data, will be considered outside of the scope of this program
Not accepted
-
Denial of service (DoS)—through network traffic, resources exhaustion, or other methods
-
User enumeration
-
Issues only present in old browsers/plugins or end-of-life software browsers
-
Phishing or social engineering of Zscaler employees, users, or clients
-
Systems or issues that relate to third-party technology used by Zscaler
-
Disclosure of known public files and other information disclosures that aren’t a material risk (e.g., robots.txt)
-
Any attack or vulnerability that hinges on a user’s computer first being compromised
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.