Voibly publishes a vulnerability disclosure program with rewards up to $5,000, submitted through their security page. A five-figure-class ceiling on a small direct program means low competition per finding — the kind of target that doesn’t appear on any platform leaderboard.
Program Overview
| Detail | Value |
|---|---|
| Reward | Up to $5,000 |
| Policy | voibly.app/security |
| Submission | Email: support@voibly.app |
| Type | Direct company program |
The security page defines scope, exclusions, and how rewards are graded. Read it first — “up to $5,000” means the ceiling is reserved for critical findings, and the page tells you exactly what they consider critical.
Attack Surface: What Makes Sense to Test
Voibly operates in the meeting and communications space — real-time product surfaces where multi-user interactions create the bugs:
- Meeting room access control. The core asset is the meeting: who can join, wait, and control the room. Test the boundaries between host and participant: can a participant escalate to host controls, access locked rooms, or retrieve materials they shouldn’t? Room-bypass class bugs are the headline findings in this product category.
- Links, tokens, and invitations. Meeting invite links are bearer tokens shared over email and chat. Check for links that remain valid after cancellation, guessable room identifiers, and invite tokens that leak more access than intended.
- Real-time signaling and media. Any real-time layer (signaling, chat, presence) parses untrusted messages from other participants. Stored XSS via chat messages, filenames, or display names rendered into the host’s view is the classic high-severity find in meeting apps.
- Accounts, teams, and scheduling. Registration, org membership, calendar integrations, and recording access. IDOR on scheduled meetings, recordings, or team objects between accounts you own is straightforward, high-yield testing.
- Integrations. Calendar and productivity integrations hold OAuth grants. Authorization flaws in the connect/disconnect flow or data leaking between connected accounts are worth serious attention.
Beginner Mistakes to Avoid
1. Joining meetings you weren’t invited to. If you find a room-access bypass, demonstrate it against rooms you created yourself. Never enter a real user’s session — the moment you observe other people’s audio, video, or chat, you’ve crossed from research into privacy violation.
2. Disrupting live meetings. No flooding, no chat spam, no join/leave loops against rooms in use. Real-time platforms are acutely sensitive to abuse patterns, and the policy will treat disruption as an attack, not a test.
3. Reporting UI glitches as security bugs. A cosmetic issue in a meeting widget is not a vulnerability. Tie every finding to concrete impact: data exposure, unauthorized access, or account compromise.
4. Testing with your main identity tied to work accounts. Register dedicated researcher accounts. Integrations and OAuth testing should never run through accounts connected to your employer or personal services.
5. Sending one-line reports. “XSS in chat, see attached” gets filed as invalid. Video: setup, payload, where it renders, who can trigger it, what an attacker steals. Reproducibility is the difference between $50 and $5,000.
Why Small Direct Programs Punch Above Their Weight
Programs like this sit in the gap aggregators miss: real payouts, published policy, dedicated submission channel — and a fraction of the hunter traffic that a Bugcrowd listing with the same ceiling would attract. Severity ceilings are public; attention levels are not. That gap is where individual hunters still find unclaimed bugs.
Next Step
Voibly is one of 51 verified programs in the Web2 Bug Bounty Targets Database — reward ranges, submission contacts, and policy links in CSV/JSON, ready to sort by payout and hunt.