Verily Life Sciences
Bounty Range
$100 - $6,000
external program
Verily Life Sciences
Bounty Range
$100 - $6,000
external program
Verily is committed to building trust and protecting the privacy and security of our users, customers and partners. We look forward to working with the security research community to discover and address vulnerabilities in our products.
| Severity | Average Bounty | Bounty Range |
|---|---|---|
| Critical (S0) | $7,000 | $6,000 - $10,000 |
| High (S1) | $4,650 | $2,000 - $5,000 |
| Medium (S2) | $860 | $750 - $1,500 |
| Low (S3) | $144 | $100 - $500 |
| Vulnerability Category | Examples | Payout |
|---|---|---|
| Remote code execution (S0) | Command injection, deserialization bugs, sandbox escapes | $6,000 - $10,000 |
| Unrestricted file system or database access (S1) | Unsandboxed XXE, SQL injection | $5,000 |
| Logic flaw bugs leaking or bypassing significant security controls impacting SPII (S1) | SPII – Direct object reference, remote user impersonation | $2,000 |
| Logic flaw bugs leaking or bypassing significant security controls impacting PII or other confidential information (S2) | PII or other confidential information – Direct object reference, remote user impersonation | $1,500 |
| Logic flaw bugs leaking or bypassing significant security controls impacting other data/systems (S2) | Other – Direct object reference, remote user impersonation | $750 - $1,000 |
| Execute code on the client (S3) | Web: Cross-site scripting, Mobile / Hardware: Code execution | $200 - $500 |
| Other valid security vulnerabilities (S3) | CSRF, Clickjacking, Mobile / Hardware: Information leak, privilege escalation | $100 - $200 |
Please note these are general guidelines, and reward decisions are up to the discretion of Verily Life Sciences.
Verily has committed to awarding submissions that discover leaked credentials according to Exemplary Standards.
The program includes 6 assets in scope. Contact the program team before submitting vulnerabilities on assets that have not been explicitly listed in the program scope. Submissions will be accepted and reviewed by the team only if the asset is confirmed to be Verily-owned.
The following are excluded from this program's scope:
Excluded endpoints: "helix.verily.com" and "enroll.onduo.com" are excluded from this program's scope. Contact forms endpoints such as https://verily.com/contact-us and https://verily.com/solutions/public-health/wastewater/contact are also not in scope for this program.
Subdomain takeover issues: Reports related to stale DNS records, subdomain takeovers or dangling IPs are out-of-scope for this program and will not be rewarded. Verily is working on an internal DNS hygiene solution to resolve these issues.
Core Ineligible Findings: Out of scope.
Ineligible vulnerability types: URL redirections, vulnerabilities requiring unlikely or impractical user interaction steps, "logout" cross-site request forgery, banner or version information leaks, and user enumeration.
Researchers should add headers to requests such as:
Thank you for helping keep Verily and our users safe!