Securitize Vulnerability Disclosure

generated: '2026-08-05'
method: searched
probe: true
source: https://securitize.io/bug-bounty
program:
  name: Securitize Bug Bounty Program
  url: https://securitize.io/bug-bounty
  self_hosted: true
  platform: none
  rewards: true
  reward_basis: severity and impact (Critical / High / Medium / Low), amount at Securitize's discretion
  response_target: status notification within two weeks
policy:
- https://securitize.io/bug-bounty
contact:
- bugbounty@securitize.io
scope:
  in_scope:
  - https://id.securitize.io/
  - https://cp.securitize.io/
  - https://id.sandbox.securitize.io/
  - https://cp.sandbox.securitize.io/
  test_credentials: >-
    Securitize issues testing credentials to authorized participants on request to the bug bounty address;
    credentials are restricted to the testing environment.
  accepted_vulnerability_classes:
  - cross-site scripting
  - sql injection
  - cross-site request forgery
  - authentication and authorization flaws
  - remote code execution
  out_of_scope:
  - third-party services not under Securitize control
  - social engineering and phishing
  - distributed denial of service
  - physical testing of office premises
  - issues caused by outdated third-party software
  notes:
  - Black-box testing is permitted against the production id. and cp. platforms.
  - Controlled, non-disruptive DDoS testing is accepted when targeting zero-days or malformed network APIs.
requirements:
- Participants must be at least 18 years old.
- Responsible disclosure — no public disclosure until Securitize resolves and publishes an advisory.
- Use test accounts; accessing or modifying real customer data is prohibited.
- Only the first reporter of a unique issue is eligible for a reward.
security_txt:
  present: false
  probed:
  - url: https://securitize.io/.well-known/security.txt
    status: 200
    result: html-catchall (Builder.io SPA shell, not a security.txt)
  - url: https://sec-connect-api-docs.securitize.io/.well-known/security.txt
    status: 404
  - url: https://domain-api-docs.securitize.io/.well-known/security.txt
    status: 404
evidence:
- source: https://securitize.io/bug-bounty
  kind: bug-bounty-policy
  http_status: 200
  extracted_via: >-
    The page is a client-rendered Builder.io SPA that serves only a title and a boilerplate paragraph to a plain
    HTTP fetch. The policy text was read from the site's own public Builder.io content API
    (https://cdn.builder.io/api/v3/content/page?apiKey=d39b51a544e84e2fbb2445f58c6c6f2c&url=%2Fbug-bounty),
    which returned the published page content — the same content a browser renders.
  keywords:
  - bug bounty program
  - responsible disclosure
  - vulnerability
  - rewards
gaps:
- >-
  The bug bounty policy is real and detailed but machine-invisible: no /.well-known/security.txt and a JS-only
  page. An RFC 9116 security.txt with Contact and Policy lines would make it discoverable by scanners and agents.
- >-
  The published submission address appears twice on the page with two different spellings — "bugbounty[at]
  securitize.io" in the credentials section and "bugbount[at]securitize.io" in the submission steps. The former is
  recorded here as the contact; the latter looks like a typo on the provider's page and is worth flagging to them.