Banner object (1)

Hack and Take the Cash !

844 bounties in database
  Back Link to program      
Constant Contact, Inc. logo
Hall of Fame

Constant Contact, Inc.

At Constant Contact the safety, privacy, and security of the data our customers entrust to us is very important to us. We welcome the reporting of security vulnerabilities in our product and services and encourage researchers to reach out to us when they find issues


We operate under the concept of responsible disclosure and require any researcher to follow the following process:

  • The researcher shares the issue with us first before he or she shares it publicly
  • We get a reasonable amount of time to address the issue before the researcher makes the information public
  • The researcher provides all the details to validate and reproduce the issue
  • The researcher makes a good faith effort to avoid impacting the service or the data contained in it
  • The researcher must not violate any laws

There are some things we explicitly ask you not to do:

  • When experimenting, please use only test accounts you control.
  • Do not run automated scans without checking with us first.
  • Do not test the physical security of our offices
  • Do not test using social engineering techniques
  • Do not perform DoS or DDoS attacks.
  • In any way disrupt our customers


To sign-up to participate, please head over to

Security is a constantly evolving field and we enjoy collaborating with the best and brightest in the security community. We always appreciate your taking the time to help us find and fix security flaws so they don't pose a serious risk to our customers.

This program only awards points for VRT based submissions.


In scope

Target name | Type
All Constant Contact websites - * | Other
Constant Contact mobile applications [iOS and Android] | Other
All Constant Contact APIs - | Other
All API SDKs | Other
All Single Platform websites - * | Other

Out of scope

Target name | Type
Any asset not explicitly listed as 'In Scope' above is explicitly out of scope | Website

Any domain/property of Constant Contact not listed in the targets section is out of scope.

Test Accounts

You're free to self-provision accounts as needed - please use your email address when creating any accounts used as part of testing.

Focus Areas

If you are looking for some focus, we would be really interested in your thoughts around our

  • APIs
  • Mobile Applications

The following finding types are specifically excluded from the bounty:

  • Descriptive error messages (e.g. Stack Traces, application or server errors).
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages.
  • Fingerprinting / banner disclosure on common/public services.
  • Disclosure of known public files or directories, (e.g. robots.txt).
  • Clickjacking and issues only exploitable through clickjacking.
  • CSRF on forms that are available to anonymous users (e.g. the contact form).
  • Logout Cross-Site Request Forgery (logout CSRF).
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
  • Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
  • Lack of Security Speedbump when leaving the site.
  • Weak Captcha / Captcha Bypass
  • Login or Forgot Password page brute force and account lockout not enforced.
  • OPTIONS HTTP method enabled
  • Username / email enumeration
    • via Login Page error message
    • via Forgot Password error message
  • Missing HTTP security headers, specifically (, e.g.
    • Strict-Transport-Security
    • X-Frame-Options
    • X-XSS-Protection
    • X-Content-Type-Options
    • Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP
    • Content-Security-Policy-Report-Only
  • SSL Issues, e.g.
    • SSL Attacks such as BEAST, BREACH, Renegotiation attack
    • SSL Forward secrecy not enabled
    • SSL weak / insecure cipher suites
  • all DMARC/SPF/DKIM issues

Out of Scope bugs for Android apps

  • Nothing. Let us know what you find.

Out of Scope bugs for iOS apps

  • Nothing. Let us know what you find

Program rules

This program follows Bugcrowd’s standard disclosure terms.

Learn more about Bugcrowd’s VRT.

This bounty requires explicit permission to disclose the results of a submission.

In Scope

Scope Type Scope Name

Constant Contact mobile applications [iOS and Android]




All Constant Contact websites - *


All Constant Contact APIs -


All Single Platform websites - *

Out of Scope

Scope Type Scope Name

Any asset not explicitly listed as 'In Scope' above is explicitly out of scope

This programe feature scope type like web_application, ios_application.

FireBounty © 2015-2019

Legal notices