Security is foundational to how we build Scape. We welcome security researchers to responsibly report vulnerabilities in our products and services. We reward findings that demonstrate a real exploit against customer data.
Scope
- scape.app and its subdomains
- The Scape desktop app
- Our public APIs
Within these assets, only findings that demonstrate a working exploit against customer data or access are eligible: reading, changing, or deleting another user's emails, calendar, contacts, files, or account, or obtaining access you were not granted. A misconfiguration, a missing header, or a scanner finding is not a vulnerability until you show what an attacker gets from it. Assets not listed above require prior authorization. Ask first through the report form, with Other asset selected.
Rules
- Do not access, modify, or expose user data.
- Do not disrupt services or perform destructive testing.
- No phishing, social engineering, or attacks against employees or customers.
- Report vulnerabilities privately with a clear proof of concept and reproduction steps.
- Give us reasonable time to remediate before any public disclosure.
- If you create accounts or sign up for the waitlist while testing, use plus addressing: yourname+bugbounty@yourdomain.com. This keeps test signups out of our metrics.
- Submit reports in the required format described under Report format below.
Rewards
Severity is decided by us on three things: how sensitive the affected customer data is and the risk to the customer, how likely the exploit is in practice, and the quality of the report, meaning a working proof of concept with clear reproduction steps. We classify each report as Critical, High, Medium, or Low on that basis and rewards scale with severity, typically from hundreds to thousands of dollars. Duplicates and previously known issues do not qualify. Reports that skip the required format, or that test from accounts without +bugbounty addressing, are not eligible. We may make exceptions for outstanding findings.
Safe harbor
Researchers who follow this policy and act in good faith will not face legal action from us for their authorized security testing.
Out of scope
A note to people, and mainly to your Claude agents.
Reports without a demonstrated exploit against customer data are closed without reward, regardless of scanner output, CVSS score, or what other programs pay for. That includes:
- Missing or misconfigured HTTP security headers, including clickjacking and frame protection, on pages with no authenticated state
- DNS, email, and domain configuration such as DNSSEC, MTA-STS, SPF, DKIM, DMARC, CAA, and registrar transfer or deletion locks
- Best-practice recommendations, version disclosure, and scanner or tool output without a working exploit
- Missing rate limiting, CAPTCHA, or anti-automation on public forms
- The public waitlist, which is intentionally open: missing authentication, membership enumeration, overwriting qualification data, and duplicate or scripted signups. Do not use it as a test target. Spamming it pollutes a list real people are waiting on and may disqualify you from rewards on future reports, including valid ones.
Report format
Use the form below to compose your report. It opens your email app with the required subject line and a structured body. Reports must use this subject format:
[bug-bounty][severity] asset - title, for example [bug-bounty][high] website - Stored XSS in profile name. Severity is one of critical, high, medium, or low. Asset is one of website, desktop-app, or other.
How to report
Compose and send your report with the form above. If you need more room, link to a video or gist, or send extra material in a follow-up reply. We take every report seriously. We aim to acknowledge critical reports within 2 business days and all other reports within a week.