1. Ultimate Member

• Rewards: $0 up to $200 per vulnerability

• Link: Ultimate Member’s Vulnerability Reward Program

Ultimate Member welcomes security issue reports. Qualifying vulnerabilities include XSS, CSRF, SQLi, RCE, and more. DoS attacks are out of scope. Rewards range from $50 to $200 based on a DREAD score model. Reports must include a proof of concept and steps to reproduce the vulnerability. Disclosure process is mutual agreement or protective disclosure. Bounty payments are subject to eligibility requirements.

2. NFON

• Rewards: $25 minimum

• Link: Responsible Disclosure Policy

NFON's Responsible Disclosure Policy encourages reporting of security vulnerabilities in their systems, with strict guidelines on what is not allowed and out of scope, and offers rewards at their discretion.

3. Flow

• Rewards: $1,000 to $100,000

• Link: Flow Responsible Disclosure

Flow's vulnerability disclosure program encourages reporting of potential vulnerabilities in their assets, with guidelines for responsible disclosure. They provide communication channels for reporting, and rewards for qualifying vulnerabilities. They exclude certain types of vulnerabilities and assets from the program, and require compliance with their guidelines for rewards.

4. Ably

• Rewards: $150 to $5,000

• Link: Ably Vulnerability Disclosure Policy

Ably's vulnerability disclosure program encourages researchers to report security or privacy vulnerabilities. The program uses the CVSS framework to rate the severity of a vulnerability and offers rewards ranging from $150 to $5000. The program applies to specific services and endpoints, and researchers are expected to follow reporting guidelines and avoid privacy violations or destruction of data. Ably reserves the right to modify the policy and may withhold rewards if researchers expose users to unnecessary risk or harm.

5. Dokobit

• Rewards: $100 minimum, no maximum

• Link: Vulnerability Disclosure Policy

Dokobit rewards security researchers for reporting vulnerabilities in their services, with a minimum reward of €100. Certain vulnerabilities are eligible for higher rewards, and bonus bounties may be awarded for valuable research. The program has specific guidelines for eligibility and responsible disclosure, and out-of-scope vulnerabilities are listed. Vulnerabilities should be disclosed to Dokobit's Cyber Incident Response Team via email