Policy and restrictions
Only explicitly covered services qualify. Real-customer interaction and disruption are prohibited; researcher identification is required and expenses are not reimbursed. Shared root causes receive one bounty. Intended own-page scripting, low-impact findings, third-party components and recently disclosed issues are excluded. Public disclosure is prohibited.
Eligibility and submission status
Newfold Digital and subsidiary employees, their family members, current vendors and vendor employees are excluded; sanctions and export-control restrictions apply. Reports require reproducible security impact. Platform first-valid-report rules apply; monetary compensation requires age 18 or the applicable age of majority.
The official brief explicitly displays In progress and an ongoing period, with a submission link. Individual eligibility remains subject to live terms.
Advertised rewards
The current chart advertises a $5,000 maximum separately from bands of P1 $2,000–$3,000, P2 $1,000–$1,500 and P3 $250–$600. The opened February 22, 2024 notice confirms these reduced rates. Ratings remain discretionary; no actual award is asserted.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
app.web.comPublished location: https://app.web.com | website | In Scope |
www.networksolutions.comPublished location: https://www.networksolutions.com | website | In Scope |
https://www.bluehost.com/ | website | In Scope |
https://www.hostgator.com/ | website | In Scope |
| Asset | Type | Group / eligibility |
|---|---|---|
*.web.comPublished location: https://*.web.com | website | Out of Scope Targets |
*.register.comPublished location: https://*.register.com | website | Out of Scope Targets |
*.networksolutions.comPublished location: https://*.networksolutions.com | website | Out of Scope Targets |
https://app.gator.com/ | website | Out of Scope Targets |
*.bluehost.com | website | Out of Scope Targets |
*.hostgator.comPublished location: https://*.hostgator.com | website | Out of Scope Targets |
Review limitations
- Brief and reviewed change index show September 11, 2026 as the latest revision. Only page 1 of 2 of the change index was reviewed; individual diffs were not opened.
- The announcement archive and February 22, 2024 reward notice were opened. The September 11, 2026 AI-builder notice was read within the brief; other archive bodies were not exhaustively reviewed.
- The chart does not explain when an award could exceed the ordinary P1 band to reach the separate $5,000 maximum.
- USD normalization uses platform accounting documentation; the brief itself uses dollar signs. No individual award or payment is established.
- Public policy pages only; authenticated submission and incorporated legal documents were not exhaustively reviewed. Asset inventories and testing instructions are omitted. Live terms prevail; this summary grants no authorization.
Sources and provenance
- Web.com Bug Bounty public brief Newfold Digital / Web.com / Bugcrowd · reviewed 2026-10-03
- Web.com Bug Bounty announcements Newfold Digital / Web.com / Bugcrowd · reviewed 2026-10-03
- Web.com Bug Bounty change index Newfold Digital / Web.com / Bugcrowd · reviewed 2026-10-03
- Bugcrowd Organization Accounting Bugcrowd · reviewed 2026-10-03
- Bugcrowd Standard Disclosure Terms Bugcrowd · reviewed 2026-10-03
- Published Bugcrowd scope groups Newfold Digital / Web.com · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.