Report a vulnerability.

Found a security issue in Epiture? Tell us privately and we will work with you on the fix. Valid reports earn up to $2,500, based on severity.

Rewards

Paid in USD by severity, after the fix ships.

Informational findings are credited but not paid. Final severity is set by our team.

Out of scope (10)

Payment and billing systems on any asset, including checkout and stored payment methods
Every asset not listed in scope, including lg.epiture.net and other subdomains
Third-party services we use, such as status.epiture.net (Better Stack), Cloudflare, and SendGrid
Workloads customers run on their own VPS instances or colocated hardware
Denial of service, volumetric, or load testing
BGP and routing attacks against AS401450
Missing headers or best practices without a working exploit (CSP, HSTS, SPF, DMARC)
Self-XSS, logout CSRF, and clickjacking on pages without sensitive actions
Scanner output without a proof of concept
Social engineering and physical attacks on offices or datacenters

One vulnerability per report. Clear steps to reproduce get triaged fastest.

Where did you find it?

portal.epiture.netCustomer portal and its APIepiture.netMarketing site, blog, and contact forms

Affected URL or endpoint

What kind of issue is it?

Weakness type *

Title *0 / 150

Your assessment. We confirm the final rating during triage.

CriticalCVSS 9.0–10.0$1,000–$2,500HighCVSS 7.0–8.9$400–$1,000MediumCVSS 4.0–6.9$100–$400LowCVSS 0.1–3.9$50–$100

CVSS vector

Plain text or Markdown. Redact any customer data you came across.

Description *0 / 10,000

Steps to reproduce *0 / 10,000

Impact *0 / 5,000

Supporting links

We do not take file uploads. Share files through a private link instead.

So we can follow up and pay the bounty.

Name or handle *

Email *

Good-faith research under these rules is authorized, and we will not pursue legal action over it.

Test only against accounts and resources you own. If you reach someone else's data, stop and report it.
Keep automated scanning under 10 requests per second, and never degrade service for others.
Don't publicly disclose until we have fixed the issue or 90 days have passed.
One vulnerability per report. When reports duplicate, the first valid one is rewarded.

I followed the rules above and have not shared this vulnerability with anyone else.

Verification not loading, or the form won't send? Email your report to abuse@epiture.net.