Mamentis runs a direct bug bounty with rewards from $50 to $5,000, published in their documentation rather than on a platform. Direct programs with a real severity ladder and almost no hunter traffic are the sweet spot for hunters who are tired of racing duplicates on HackerOne.
Program Overview
| Detail | Value |
|---|---|
| Reward range | $50 – $5,000 |
| Policy | mamentis.com/docs/resources/miscellaneous/submit-bug-request |
| Submission | Documented on the policy page; security contact listed there |
| Type | Direct company program |
The submission instructions live inside their docs under “Submit Bug Request” — follow those exactly. Programs that document submission as part of their support workflow tend to respond faster than email-only disclosures, but they also expect reports in a specific format.
Attack Surface: What Makes Sense to Test
Mamentis operates in the hosting/infrastructure space, and hosting platforms have a predictable, well-defined set of high-value targets:
- Customer panel and account management. Registration, login, password reset, and session handling are the bread and butter. Password reset flows that leak account existence or accept mismatched tokens are classic $500–$1,500 finds.
- Authorization between accounts. Multi-tenant platforms live or die on object-level access control. Enumerate your own account’s object IDs and test whether they resolve from a second account you own — IDOR here is usually top-tier severity.
- Ordering, billing, and service provisioning logic. Hosted products have real money flows. Negative quantities, currency confusion, promo-code abuse, or a provisioning flow you can trigger in the wrong state are logical vulnerabilities scanners never find.
- Public-facing infrastructure endpoints. Status pages, API endpoints, and customer-facing DNS or mail tooling. Check the policy scope first, but anything processing untrusted input is fair game when in scope.
- Documentation and support tooling. Docs sites and ticket systems are often forgotten during security reviews. Reflected XSS in search or support flows is lower severity but pays the $50–$200 rungs while you learn the platform.
Beginner Mistakes to Avoid
1. Testing outside the documented scope. The docs page defines what’s included. Infrastructure edge devices (mail relays, name servers) are frequently excluded. Confirm scope per-asset before you spend an evening on it.
2. Breaking the terms of service to find a bug. Creating accounts at scale, reselling test services, or hammering endpoints crosses from research into abuse. One test account, low volume, clean PoC.
3. Reporting the same class twice. If stored XSS in panel feature A gets accepted, six more variants of the same bug in sibling features are usually treated as one finding. Batch them or expect duplicates.
4. Writing reports without reproduction steps. URL, account setup, request sequence, expected vs. actual behavior, and impact in one sentence. If the triager can’t reproduce it in five minutes, severity gets guessed downward.
5. Ignoring the payout process. Direct programs pay by their own method and timeline, not a platform’s. Read how rewards are issued before submitting so your payment details and expectations line up.
The Case for Small Direct Programs
A $5,000 ceiling on a program with almost no public hunter traffic is, per-hour, often better than the same ceiling on a crowded platform. The trade-off is that nobody writes tutorials about these programs, and finding them requires either heavy manual recon or a maintained dataset. This one was surfaced in exactly that kind of systematic sweep of company security pages.
Next Step
The Web2 Bug Bounty Targets Database contains 51 verified programs like this one — reward ranges, contacts, and policy links in CSV/JSON. Load it into a spreadsheet, filter by payout, and pick your next target in minutes instead of days.