Superside is a design-as-a-service platform — enterprises subscribe to a creative team that delivers brand assets, ads, and video through a collaborative web app. Their published bug bounty policy lists rewards from $200 to $2,000 in defined tiers. Note the floor: $200 minimum on published tiers means even a mid-severity find pays better here than most “we’ll send a t-shirt” programs.
Program Overview
| Detail | Value |
|---|---|
| Reward range | $200 – $2,000 (published tiers) |
| Policy | superside.com/bug-bounty-program-policy |
| Submission | Through the policy page |
| Type | Direct company program |
The policy is a full program document — scope, exclusions, and the tier table live there. Read the exclusions list completely; it’s the cheapest way to avoid spending a day on a bug class they’ve already ruled out.
Attack Surface: What Makes Sense to Test
A creative-services SaaS is a workflow platform: files, projects, briefs, feedback threads, and delivery. That shape points at specific bug classes:
- File handling. The product moves design files — uploads, previews, and downloads flow constantly. Test upload filtering (HTML/SVG files that render on their domain become stored XSS), filename and metadata handling, and access control on delivered assets. Preview pipelines that convert file formats are a classic source of server-side bugs.
- Project and team boundaries. Superside organizes work by customer workspaces. The core authorization question: can a user from workspace A read projects, briefs, or messages in workspace B? Object-level access control on project IDs is the highest-yield test on any workflow SaaS.
- Feedback and collaboration features. Comments, annotations, and approval flows accept rich user input rendered to other users — often including the vendor’s own team members. Stored XSS in a comment seen by a Superside employee is a genuine account-takeover path, not a self-XSS footnote.
- Account and subscription flows. Plan upgrades, seats, and billing settings. Authorization gaps on org-level actions (inviting members, changing plans) and pre-auth information disclosure on account endpoints.
- Integrations. Slack, cloud storage, and design-tool connections hold OAuth grants. Check that disconnecting an integration actually revokes access, and that token exchange flows can’t be replayed.
Beginner Mistakes to Avoid
1. Skipping the published tier table. The policy maps severity to dollars — use it. Reports claiming a tier the table doesn’t support get downgraded, and downgrade disputes poison the relationship before it starts.
2. Testing on real customer workspaces. Sign up as a real customer on your own account and generate your own projects. Every cross-workspace test should run between accounts you control. Any glimpse of a real customer’s brand assets is a privacy incident, not a proof.
3. Uploading deliberately malicious files at volume. One crafted test file, clearly labeled, on your own account. Bulk-uploading payloads to a production file pipeline looks like an attack and frequently triggers abuse systems.
4. Reporting out-of-scope classes. Missing headers, self-XSS, logout CSRF, and rate-limit findings appear on every exclusion list ever written. Check before you write.
5. Vague impact statements. “Could lead to account takeover” with no path won’t earn a tier. Show the chain: payload → where it renders → whose session → what data is reachable. Tiers are granted on demonstrated impact.
Why Mid-Tier SaaS Direct Programs Are Efficient Targets
A $2,000 ceiling on a platform program typically means racing dozens of hunters through one triage queue. The same ceiling on a direct program means a small security inbox reading your report directly — fewer duplicates, faster responses, and severity discussions with the people who own the code. Published tier floors ($200+) also signal that this company budgets for bounties rather than treating disclosure as a compliance checkbox.
Next Step
Superside is one of 51 verified programs in the Web2 Bug Bounty Targets Database — reward ranges, submission contacts, and policy links in CSV/JSON. Filter by tier, pick a target, and submit this week instead of scrolling Twitter for leads.