Zivver – Bug Bounty Program
Bounty Range
$1 - $10,000
external program
Bounty Range
$1 - $10,000
external program
BountyHall of fame
$1 Low $500 Medium $1,000 High $3,000 Critical $10,000
Avg reward -
Max reward -
Scopes11
Supported languagesEnglish
Reports709
1st response < 1 day
Reports last 24h9
Reports last week22
Reports this month114
Program description
Program activity
Enabled Leaks and exposed credentials
Enabled Systemic Issues grid
Launch of the program.
Zivver offers secure communication solutions that help prevent data leaks. The Saas solution offers a web application and clients for Outlook, Outlook Web Access and Gmail. The product has:
Zero-knowledge encryption (https://www.zivver.com/hubfs/whitepapers/7941%20-%20ZVR%20-%20Whitepaper%20-%20Security%20By%20Design%20-%20EN%20-%20AW.pdf?utm_campaign=GLB-22-Q1-REPORT-PERFORMANCE&utm_source=Resource%20hub&utm_content=Privacy%20by%20design)
Human error prevention
Large file transfer
Email revocation
Secure eSignatures
Proof of Delivery
Several enterprise features as role based access, SSO and reporting
With this bug bounty program, we want to reinforce our commitment to security and reward security researchers for helping us protect our customers' data.
Zivver wants to increase the security of its products by inviting security researchers to analyze the implementation of security measures in its product and to identify existing vulnerabilities. In order to achieve this goal together, it is important to us that the following rules are adhered to.
Only attempt attacks using an account associated with your YesWeHack email alias. Any breach attempts from other accounts might be considered a threat to our customers and the associated accounts will be shut off without further notice. Other accounts than the ones associated with your YesWeHack email alias will not necessarily receive safe harbor protection.
Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
Causing load-based issues by submitting an unreasonably large number of requests or transferring an excessive amount of data.
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
Only interact with accounts you own or with explicit permission of the account holder.
Do not change passwords of accounts (unless it’s your own) or delete other accounts.
Do not publish (even partially) any vulnerabilities that are found.
Do not claim any domain related to YesWeHack (yeswehack.com, yeswehack.ninja) in the product once you received a business account!
This will make signups for other hunters impossible using their YesWeHack email alias. We will delete any account that claims any of those domains without notification.
We are happy to thank everyone who submits valid reports to improve the security of our service, however only those that meet the following eligibility requirements may receive a monetary reward:
You must be the first reporter of a vulnerability.
The vulnerability must be a qualifying vulnerability (see below).
Show meaningful impact: reports that note deviations from security 'best practices' but cannot present a clear proof of risk —such as flagging a missing X-Content-Type-Options header on a page that never handles user content—are ineligible for rewards, though we may accept the report for its informational value. This policy ensures we concentrate bounty funds on genuine, exploitable threats rather than theoretical issues.
Any vulnerability found must be reported no later than 24 hours after discovery and exclusively through YesWeHack.
The vulnerability report must contain the following elements:
A clear textual description of the vulnerability, how it can be exploited, its security impact and remediation advice.
A proof of the exploitation of the vulnerability (e.g. screenshots, proof of concept code).
The preconditions and steps required to reproduce the issue including code snippets, commands, request information, payloads, etc.
You must not be a former or current employee of our company or one of its contractors.
Please note that for any reports involving Cross-Site Scripting (XSS), a basic proof-of-concept such as a JavaScript alert box (e.g., alert(1)) will not be considered sufficient for triage or reward. To qualify for a valid report, you must demonstrate a clear and actionable impact resulting from the XSS vulnerability. This includes, but is not limited to:
Performing actions on behalf of another user (e.g., creating a new user account or modifying user settings)
Exfiltrating sensitive data (e.g., sending authentication cookies or session tokens to an external server)
Bypassing security controls or escalating privileges
The goal is to understand the real-world risk and exploitability of the issue, so please ensure your report includes a well-documented and impactful demonstration.
When reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
[https://app.zivver.com/signup](Zivver signup page)
[https://docs.zivver.com/en/index.html](Zivver knowledge base)
Asset value | CVSS Low | CVSS Medium | CVSS High | CVSS Critical | High | $500 | $1,000 | $3,000 | $10,000 |
1st report100% 2nd report100% 3rd report75% 4th report50% 5th report25% 6th+ report10%
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and policy. To summarize our policy, you may refer to the below table:
More info
Scope | Type | Asset value | Expand rewards grid | app.zivver.com | Web application | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| owa-v6.zivver.com | API | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| collector.zivver.com | API | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| downloads.zivver.com | API | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| img.zivver.com | API | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| sign.zivver.com | Web application | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| https://play.google.com/store/apps/details?id=com.zivver.app | Mobile application Android | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| https://apps.apple.com/be/app/zivver/id1179528663 | Mobile application IOS | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| Zivver Outlook Plugin | Other | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| Zivver OWA add-in | Other | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
| Zivver Chrome Extension | Other | High | | Low $500
Medium $1,000
High $3,000
Critical $10,000
|
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and policy. To summarize our policy, you may refer to the below table:
More info
Type of leak Source of leak is in-scope Source of leak belongs to the Organization and is out-of-scope Source of leak does not belong to the Organization and is out-of-scope
Impact is in-scope (e.g. valid credentials on an in-scope asset) Eligible Eligible Not eligible
Impact is out-of-scope (e.g. valid credentials for an out-of-scope asset) Eligible Not eligible Not eligible
Please sign up for a freemium account here using your YesWeHack email alias: https://app.zivver.com/signup
Complete account setup steps as outlined here: https://docs.zivver.com/en/guest/signup-for-zivver.html
🚫 Do not claim any domain associated with YesWeHack (e.g., yeswehack.com, yeswehack.ninja) in the product once you received a business account.
Please append to your user-agent header the following value: ' -bug-bounty-yeswehack-[your_username] '.
When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.
For more information, see [https://helpcenter.yeswehack.io/hunter/hunter-collaboration](help center). Note: For reports that have already been rewarded, it is not possible to redistribute the rewards.
To submit a vulnerability report, you need to login with your hunter account. /programs/zivver-bug-bounty-program/create-report