CleanShot is the screenshot and screen-recording utility that much of the Mac productivity world runs daily. Their disclosure program pays $50 to $4,000, with reports going through a simple web policy page. The program surfaced publicly only recently, which for hunters means a target that hasn’t been picked over yet.
Program Overview
| Detail | Value |
|---|---|
| Reward range | $50 – $4,000 |
| Policy | cleanshot.com/disclosure |
| Submission | Email: security@cleanshot.com |
| Type | Direct company program |
One scope note worth knowing upfront: CleanShot’s core product is a native macOS application. The policy defines whether and how web assets and the cloud/sync side are covered — read that section carefully, because it changes where your hours should go.
Attack Surface: What Makes Sense to Test
A screenshot utility with cloud features has a split surface — and the web/cloud half is where Web2 skills apply directly:
- Sharing links and cloud storage. CleanShot’s headline feature is instant shareable links for captures. That’s bearer-token territory: are share URLs unguessable? Can a capture remain accessible after deletion? Can you enumerate or access captures that belong to other users by manipulating link identifiers? Access control on shared captures is the most valuable bug class this product can have.
- Account and subscription handling. License validation, upgrade flows, and account settings on the web side. Authorization flaws between accounts and weak session handling are standard, reliable checks.
- Upload and rendering pipeline. Shared captures are uploaded files that get rendered in a viewer for third parties. Malicious file handling — HTML served on the sharing domain, SVG with embedded scripts, content-type confusion — can become stored XSS on the share page. Where the sharing domain sits relative to the main site (sandboxed subdomain or not) determines severity.
- The API behind the app. The macOS client talks to a backend: uploads, history, team features. Anything the client can do, an unauthorized request shouldn’t. Intercept the app’s traffic and test the endpoints directly with modified parameters.
- The native app itself (if in scope). If desktop components are covered, privilege and entitlement issues matter — but confirm scope first, and note that product policy details matter more here than on pure web targets.
Beginner Mistakes to Avoid
1. Ignoring the app-vs-web scope split. Writing up a desktop app finding when the policy covers only web assets (or vice versa) wastes everyone’s time. The disclosure page draws the line — find it before testing.
2. Accessing other users’ captures. If you discover a way to reach captures you don’t own, verify the mechanism with your own two accounts and stop. Never view, download, or retain anyone else’s screenshots — they routinely contain private data, and doing so converts your finding into an incident.
3. Testing the macOS app destructively. No crashing the app on your machine and calling it a DoS. Local crashes without a security boundary are not vulnerabilities.
4. Missing the sharing-domain subtlety. Many hunters report “there’s an HTML file on their CDN” without checking where that domain sits in the trust model. Read how the share domain is scoped before grading severity — the difference between share.vendor.com and a sandbox domain is the difference between P2 and informational.
5. Uploading malicious content as a first move. Craft your PoC files to prove the rendering flaw with zero blast radius, and say explicitly in the report that no other user data was touched.
Why Recently-Discovered Programs Are Prime Targets
Public indexing of this program is recent, and that’s the feature. The value of any bug bounty target is roughly its ceiling divided by the number of active hunters who know it exists. A $4,000 ceiling with near-zero awareness is mathematically better than a $10,000 ceiling with a thousand hunters on it. The skill is not testing harder — it’s finding programs earlier, which is a research problem, not a hacking one.
Next Step
CleanShot is one of 51 verified programs in the Web2 Bug Bounty Targets Database — reward ranges, submission contacts, and policy links in CSV/JSON, so your next under-hunted target is a filter away.