generated: '2026-07-18'
method: searched
source: https://www.getbyrd.com/en/vulnerability-disclosure-program
policy: [https://www.getbyrd.com/en/vulnerability-disclosure-program]
contact: [security@getbyrd.com]
bug_bounty: null
program_type: self-managed vulnerability disclosure program (no bounty)
scope: "*.getbyrd.com"
out_of_scope:
  - volumetric / denial-of-service attacks
  - TLS configuration weaknesses
  - non-exploitable / best-practice-only findings
qualifying:
  - SQL injection
  - cross-site scripting (XSS)
  - remote code execution (RCE)
  - insecure direct object reference (IDOR)
  - authentication bypass
  - cross-site request forgery (with real impact)
rules:
  - Automated scanners limited to one request per second maximum.
  - Identify yourself via User-Agent "VDP name-at-email-dot-com".
  - Acknowledgement targeted within 72 working hours.
  - byrd affirms it will not pursue legal action against good-faith researchers.
safe_harbor: true
evidence:
  - {source: https://www.getbyrd.com/en/vulnerability-disclosure-program, kind: disclosure-page}
  - {source: https://www.getbyrd.com/en/security-startpage, kind: trust-center-link}