Atmail is an email hosting and webmail platform — the kind of software that runs mailboxes for ISPs, universities, and hosting providers. Their bug bounty terms list rewards from $50 up to $5,000. Email platforms are a rich target class: they hold credentials, personal data, and message content, so the severity ceiling reflects genuine business risk.
Program Overview
| Detail | Value |
|---|---|
| Reward range | $50 – $5,000 (per program terms) |
| Policy | atmail.com/bug-bounty-terms |
| Submission | Email: security@atmail.com |
| Type | Direct company program |
Two things worth flagging from the terms page: first, the terms govern the whole relationship, so read them before touching anything. Second, this program surfaced publicly only recently — its indexing history is thin, meaning fewer hunters have combed through it. New-and-quiet programs are where duplicate-free reports live.
Attack Surface: What an Email Platform Offers
Email is one of the oldest and most attack-rich software categories. Reasonable starting points:
- Webmail client. The browser-facing interface is the classic surface: stored XSS via email HTML content, CSRF on state-changing actions, and attachment-handling flaws. Webmail XSS is high-severity precisely because it can read every future email in the victim’s inbox.
- Authentication and session handling. Password reset flows, “remember me” logic, session fixation after login, and privilege boundaries between mailbox admin and user are all high-yield.
- Admin panels. Hosting-grade mail products ship admin interfaces for managing domains, quotas, and accounts. Broken access control here — a regular user reaching an admin route — is typically a top-tier payout.
- Mail protocol edges. IMAP/SMTP/POP proxies and webmail-to-backend translation layers parse untrusted input constantly. Encoding quirks, header injection, and command injection in mail-processing paths are realistic finds.
- Tenant isolation. If Atmail runs multi-tenant hosting, crossing tenant boundaries — one customer’s admin seeing another’s mailboxes — is the single most valuable bug class on the board.
Beginner Mistakes to Avoid
1. Sending test emails to addresses you don’t control. Never probe with other people’s mailboxes. Register your own test account and domain, and do all cross-account testing between accounts you own.
2. Confusing a finding in a third-party library with an in-scope finding. Webmail UIs are full of third-party JavaScript. Check the terms for what counts as in-scope before writing up a library bug that’s already public.
3. Testing deliverability or spam features at volume. Sending bursts of test mail looks like spam and can trip abuse systems. One or two crafted test messages between your own accounts is the professional way.
4. Skipping the severity mapping. The terms define what each reward tier expects. A report claiming $5,000 for a self-XSS or a missing header reads as noise and can get your whole submission discarded.
5. Assuming the program is inactive because it’s quiet. Small direct programs often have slow triage. Wait the period the terms specify before following up — a polite nudge after 30 days is fine; three emails in a week is not.
Why Quiet Direct Programs Are Worth Your Time
The economics of bug bounty are brutally simple: payout × probability of a non-duplicate. A $5,000 ceiling on a program few hunters know about often beats a $5,000 ceiling on a HackerOne program where twenty hunters raced you to the same IDOR. The catch is discovery — these programs live on /.well-known/ files, policy pages, and buried terms URLs that no aggregator indexes well.
Next Step
That discovery problem is solved by the Web2 Bug Bounty Targets Database — 51 verified programs including Atmail, each with reward range, submission contact, and policy link, delivered as CSV/JSON you can sort and filter.