Nitro Software Vulnerability Disclosure

generated: '2026-07-20'
method: searched
probe: true
source: https://www.gonitro.com/security-compliance/security/responsible-disclosure
policy:
- https://www.gonitro.com/security-compliance/security/responsible-disclosure
contact:
- security@gonitro.com
rewards: true
rewards_note: Qualifying vulnerabilities reported through the program may be eligible for rewards.
safe_harbor: Nitro will not pursue legal action against researchers who comply with the policy.
scope:
- Nitro Pro (Windows, Mac, iOS)
- Nitro Sign
- Nitro Admin
- Workspace
- Nitro Identity
rules:
- Only test accounts you own or have explicit permission to access
- Proof-of-concept only; do not exploit beyond demonstrating the vulnerability
- Delete sensitive data immediately after reporting
- No disruptive activities (social engineering, phishing, DoS)
- First reporter receives the reward; confidentiality required until written permission to disclose
out_of_scope:
- Social engineering
- Self-XSS
- Version disclosure without exploit
- Weak password policies
- CSRF on anonymous forms
evidence:
- source: https://www.gonitro.com/security-compliance/security/responsible-disclosure
  kind: responsible-disclosure-page
- source: security/nitro-software-domain-security.yml
  kind: dns-caa-iodef
  detail: gonitro.com CAA iodef mailto:security@gonitro.com