Public bug bountyLaunched Mar 2026 · Updated 2 months ago

Northwind Cloud

Cloud infrastructure & developer platform · northwind.com

Accepting reports
Public
Managed triage
Safe harbour

Your access

Open to every researcher

Submit a report Read the rules of engagement first

Max bounty: $8,000
Avg. response: 1.8 days
Reports resolved: 118
Bounties paid: $214k
Researchers: 42

Overview

Northwind Cloud runs a public bug bounty program covering its production platform, public API and mobile apps. We reward valid, in-scope vulnerabilities by severity and aim to respond to every report within two business days.

Program terms

Type: Public
Rewards: Bounty · USD
Triage: Managed
Disclosure: Coordinated
Safe harbour: Offered
Status: Active

Response targets

First response: 2 days
Triage decision: 4 days
Resolution: 30 days
Avg. first response: 1.8 days

Scope

4 in · 4 out

In scope

In-scope assets
Asset	Type	Environment
*.northwind.com	Web	Production
api.northwind.com	API	Production
Northwind iOS app	Mobile	Production
Web dashboard	Web	Production

Out of scope

Out-of-scope assets and activities
Asset or activity	Reason
status.northwind.com	—
Third-party marketing sites	—
Denial-of-service / volumetric	—
Social engineering & physical	—

Not rewarded

Denial of service / volumetric attacks
Self-XSS requiring victim-side paste
Missing security headers without demonstrated impact
Rate-limit or user enumeration without demonstrated impact
SPF / DKIM / DMARC configuration
Social engineering of staff or users
Best-practice reports with no security consequence

Rewards

USD · per valid finding

Rewards by severity
Severity	Bounty
CriticalRCE, auth bypass, mass data exposure	$8,000from $3,200
HighSSRF, stored XSS, privilege escalation	$3,000from $1,200
MediumIDOR, CSRF on sensitive actions	$750from $300
LowReflected XSS, minor info disclosure	$150from $60

Final severity is set by Zerohunt triage.Ranges are per valid, in-scope finding.

Rules of engagement

5 rules

Test only assets listed in scope. Never access, modify or delete data that does not belong to your test account.
Use your own test accounts. Stop immediately if you encounter another user's data and report it.
No denial-of-service, automated scanning at scale, or social engineering of staff or users.
Report each vulnerability once, with clear reproduction steps and evidence. Duplicates are closed against the earliest valid report.
Keep findings confidential until Northwind confirms a fix and agrees to disclosure. Good-faith research is authorized and will not be pursued legally.

Testing requirements

Use the test accounts issued to you. Tag automated traffic with a `X-Bug-Bounty: <your-handle>` header and keep request rates below 5/s.

Authorization

Testing is authorized only within the scope and rules on this page. Findings outside scope are not eligible and may not be protected under safe harbour.

Disclosure & safe harbour

Disclosure policy

Coordinated

Northwind Cloud agrees a publication date with you once the issue is resolved.

Safe harbour

Offered

Northwind Cloud will not pursue legal action against good-faith research within these rules.

Safe harbour statement

Northwind will not pursue civil or criminal action, or send notice to law enforcement, for accidental or good-faith violations of this policy. We consider research conducted under it to be authorized, lawful and helpful to the overall security of the internet. You remain responsible for complying with any other applicable laws.

Recent activity

Latest 4

CriticalAuth bypass on API token refreshResolved · $8,000
HighStored XSS in dashboard commentsResolved · $3,000
MediumIDOR on invoice export endpointAccepted
LowReflected XSS on search parameterResolved · $150

Ready to report

Found something on Northwind Cloud?

Submit a structured report with steps and evidence. Managed triage reviews it, and a valid finding is rewarded by severity.

Submit a report All programs