Bug Bounty & Vulnerability Disclosure Program
We are committed to protecting our users' data and the integrity of our platform. If you believe you have found a security vulnerability in Two Minute Reports, we want to hear from you. Verified critical vulnerabilities that pass our internal review are eligible for a reward; other valid findings, including those identified using AI tools, are fixed and acknowledged.
Program started: July 24, 2026 · Policy & scope last updated: October 29, 2026
Our Commitment
We value the work of security researchers and the broader security community. We pledge to investigate every valid report, keep you informed throughout the process, resolve confirmed vulnerabilities promptly, and reward verified critical findings reported under this policy.
Safe Harbor
Security research conducted in good faith and in accordance with this policy is considered authorized. We will not initiate legal action against you, or ask law enforcement to investigate you, for discovering and reporting vulnerabilities under this program.
Program Scope
Only testing against the assets listed below is authorized under this program. If you are unsure whether something is in scope, ask us first at [email protected].
In Scope
Web application
https://www.twominutereports.com and all its pages
Owned subdomains
Subdomains fully owned and operated by Two Minute Reports (e.g., hub.twominutereports.com)
Public APIs
Publicly accessible API endpoints operated by Two Minute Reports
Official add-ons
Two Minute Reports apps and add-ons published by us (e.g., our Google Workspace add-on)
Out of Scope
- Social engineering (phishing, vishing) of our employees, contractors, or users
- Denial of Service (DoS/DDoS) or resource-exhaustion attacks
- Bulk automated vulnerability scanning that generates high volumes of traffic
- Third-party applications or services not owned or managed by Two Minute Reports
- Testing against production accounts that are not your own
- Missing security headers or best-practice flags without a demonstrable exploit
- Email spoofing findings (SPF/DKIM/DMARC) without a working proof of concept
- Self-XSS or issues requiring unlikely user interaction
- Clickjacking on pages with no sensitive actions
- Basic or informational findings without demonstrated security impact (e.g., software version disclosure, verbose error messages, descriptive stack traces)
- Theoretical vulnerabilities without a working proof of concept against our current production systems
- Open redirects without demonstrated additional security impact
- Missing rate limiting on endpoints other than authentication
- CSRF on unauthenticated forms or on actions with no security impact (e.g., logout)
- Content spoofing or text injection without HTML or script execution
- SSL/TLS configuration findings (e.g., cipher suites) without a practical exploit
- Duplicate reports of issues already reported by another researcher or known to us
- Reports produced by AI tools or automated scanners that have not been manually validated
Rewards for verified critical vulnerabilities
Up to $100 for critical vulnerabilities
Only critical vulnerabilities that pass our internal review are eligible for a monetary reward. Findings identified using AI tools, and all other valid findings, are eligible for recognition only.
Reward guidelines
- Every report is verified: Our security team independently reproduces each report. A reward is paid only after we confirm the issue and its impact on our current production systems, and the finding passes our internal security review.
- Evidence is required: Reports must include a working proof of concept, step-by-step reproduction, screenshots or video, and the raw HTTP requests and responses or output from the security tools you used. Reports without this evidence are closed without a reward.
- Findings identified using AI tools: Vulnerabilities found using AI tools are eligible for recognition only, not monetary rewards, even when they are valid and critical. Please state in your report whether you used AI tools. If we determine that a finding was identified using AI tools and this was not disclosed, it is not eligible for a reward. Reports generated by AI without manual validation, such as theoretical issues, references to endpoints or behavior that do not exist in our product, or generic descriptions without a proof of concept, are closed after verification. Repeated submissions of this kind are treated as spam under our Abuse Prevention rules.
- Severity is based on actual impact: We classify severity by the impact you demonstrate, not by theoretical worst cases or automated CVSS scores. Final classification and reward eligibility are at the sole discretion of Two Minute Reports.
- One reward per root cause: Multiple reports or variants that stem from the same underlying issue are treated as a single finding.
- Duplicate reports: if the same vulnerability is reported by more than one researcher, only the first complete, reproducible report we receive is eligible for a reward (based on the time the report arrives in our inbox). Later reports of the same issue are marked as duplicates and are not eligible, though we will let you know the issue was already reported.
- Subscription credits can be applied to your own account or gifted to another account.
- Out-of-scope submissions and reports submitted by researchers previously suspended for abuse are not eligible for rewards.
How to Report a Vulnerability
Email your report to [email protected]. For critical issues that need immediate attention, include "URGENT" in the subject line. Please include the following in your report:
Vulnerability description
A clear and concise explanation of the issue
Steps to reproduce
Detailed instructions so we can replicate the vulnerability
Proof of Concept
Screenshots or video, plus the raw HTTP requests and responses that show the issue
Demonstrated impact
What an attacker can actually do, shown on your own test accounts — not a theoretical risk
Affected URLs / endpoints
The specific locations where the vulnerability was found
Environment and tools
Browser, operating system, the security tools you used (e.g., Burp Suite, OWASP ZAP), and whether you used any AI tools
Rules of Engagement
Please Do
- Only interact with accounts and test data you own
- Report vulnerabilities as soon as possible after discovery
- Provide clear, detailed reports with reproduction steps
- Give us reasonable time to fix issues before any public disclosure (minimum 90 days)
- Comply with all applicable laws and regulations
Please Don't
- Access, modify, or destroy data belonging to other users
- Publicly disclose a vulnerability before we have addressed it
- Perform testing that could degrade or disrupt our services
- Exploit a vulnerability beyond what is needed to demonstrate it
- Demand payment before disclosing the details of a finding
- Conduct continuous, aggressive, or high-volume testing attacks
- Create multiple test accounts or attempt account enumeration
- Insert, modify, or delete data in our databases (even test data)
- Engage in activities that spam our security team with low-quality or duplicate reports
Abuse Prevention & Program Suspension
This program is intended for responsible security researchers conducting good-faith testing. Researchers who engage in any of the following activities will be banned from the program permanently:
- Continuous or aggressive testing: Repeatedly scanning, attacking, or probing our infrastructure without prior coordination, or sending high-volume requests that disrupt service
- Unauthorized account creation: Creating multiple test accounts, enumeration attempts, or account abuse under the premise of security research
- Data manipulation: Inserting, modifying, or deleting data in our production or test databases without explicit authorization from our security team
- Spam or low-quality reports: Submitting numerous trivial, duplicate, low-effort, or unvalidated AI-generated reports to inflate submission counts or attempt to claim rewards
- Extortion or threats: Threatening to publicly disclose vulnerabilities, demand payment, or cause harm to our service or reputation
Violations will result in immediate and permanent suspension from the bug bounty program, forfeiture of any pending rewards, and potential legal action.
Coordinated Disclosure
We ask that you keep the details of any vulnerability confidential until we have remediated it, or until 90 days have passed since acknowledgment — whichever comes first. We are happy to coordinate on public disclosure once a fix is in place.
Recognition
Valid findings of any severity, including those identified using AI tools, are eligible for recognition. With your explicit consent, we are glad to publicly acknowledge your contribution once the issue is resolved. You may also choose to remain anonymous — recognition is always optional and never a condition of receiving a reward.
Eligibility
You must be legally able to receive rewards under the laws of your jurisdiction. Current employees and contractors of Two Minute Reports, and their immediate family members, are not eligible for rewards. You must not be on any sanctions list or located in a country subject to trade restrictions.
Program Terms
Participation in this program constitutes acceptance of these terms. Two Minute Reports reserves the right to modify the scope, rewards, or terms of this program at any time; significant changes will be reflected on this page. Reports are assessed under the policy in effect on the date we receive them. Severity classification and final reward amounts are at our sole discretion, and disputes will be resolved through good-faith discussion.
Third-Party Service Integration Scope: Vulnerability testing must focus strictly on Two Minute Reports' assets and API endpoints. Security testing directly against third-party integrated services (such as Google Ads API, Google Sheets, Meta Graph API, or Amazon Web Services) is strictly prohibited under this program and must be reported directly to those respective platforms.
This program does not authorize testing against systems we do not own, and it does not permit any activity that violates applicable law. When in doubt, contact us at [email protected] before testing.
Found something? Let us know.
Every report helps keep Two Minute Reports safe for everyone. We read and respond to every submission.
Email [email protected]