generated: '2026-08-04'
method: searched
probe: true
source: https://www.coda.co/policy/coda-payments-vulnerability-disclosure-policy
policy:
- https://www.coda.co/policy/coda-payments-vulnerability-disclosure-policy
contact:
- form: https://docs.google.com/forms/d/e/1FAIpQLSeYhakiEbaPgcGl8fJFYsk-y_VbR4t292rXiN7JFY15nL8-Xg/viewform
  note: >-
    The published policy directs researchers to submit findings only via the Vulnerability
    Submission Form; no security@ address is published for reports.
security_txt:
  present: false
  probed:
  - {url: 'https://www.coda.co/.well-known/security.txt', status: 404}
  - {url: 'https://www.codapayments.com/.well-known/security.txt', status: 404}
  - {url: 'https://airtime.codapayments.com/.well-known/security.txt', status: 404}
  - {url: 'https://sandbox.codapayments.com/.well-known/security.txt', status: 404}
  - {url: 'https://api-tc.codapayments.com/.well-known/security.txt', status: 403}
  - {url: 'https://payout.codapayments.com/.well-known/security.txt', status: 403}
  - {url: 'https://docs.coda.co/.well-known/security.txt', status: 404}
  note: >-
    Coda runs a real disclosure program but does not advertise it at the RFC 9116 path.
    Publishing /.well-known/security.txt pointing at the policy URL would make it
    machine-discoverable.
bug_bounty:
  present: true
  self_hosted: true
  platform: none (self-run, submissions via Google Form)
  rewards:
    currency: USD
    bands:
      medium: 250-500
      critical: 5000-7000
    payout_methods:
    - Payoneer
    - PayPal
  response_commitments:
    acknowledgement: within 7 days
    reward_decision: within 15 days for eligible vulnerabilities
scope:
  in_scope:
  - '*.codashop.com'
  - '*.codacash.com'
  - '*.codapayments.com'
  - '*.coda.co'
  - giftcloud.com
  - specific Startselect URLs
  out_of_scope:
  - support portals
  - CDNs
  - denial of service
  - phishing / social engineering
  - third-party vulnerabilities
  - self-XSS
safe_harbor:
  published: true
  conditions:
  - no public disclosure before resolution
  - no access to accounts the researcher does not own
  - communicate only with Coda's security team
  note: >-
    "Violation of any of the above actions will result in the void of rewards and
    rejection of all future reports."
evidence:
- source: https://www.coda.co/policy/coda-payments-vulnerability-disclosure-policy
  kind: vulnerability-disclosure-policy
  http_status: 200
  fetched: '2026-08-04'
- source: https://www.coda.co/security/
  kind: security-page-link
  http_status: 200
  fetched: '2026-08-04'
  note: >-
    "We encourage you to read through Vulnerability Disclosure Policy and share your
    findings with us through our dedicated reporting channels."