Skip to main content
Mizu CRM
Security

Bug Bounty Program

Help us find vulnerabilities and earn free Mizu CRM subscription months - up to 3 months free plus a discount coupon for critical findings. No cash, just real product value.

Program active

87

Researchers rewarded

214

Reports resolved

< 24 hrs

Response time

Active

Program status

Quick facts

Reward typeFree subscription months + coupon codes
Reward range1 month (Low) -> 3 months + coupon (Critical)
Initial response24-48 hours
Disclosure window90 days (coordinated)
PlatformHackerOne / Intigriti
Program launchedApril 28, 2026
StatusActive

Reward tiers

All rewards are free Mizu CRM subscription months applied to any paid plan. No cash, no wire transfers just real product value.

Critical

3 months free + coupon code

High

3 months free

Medium

2 months free

Low

1 month free

Critical
3 months free + coupon code

3 months free on any paid plan, plus a discount coupon code for future renewals.

  • Remote code execution (RCE)
  • SQL injection leading to data breach
  • Authentication bypass on production
  • Complete account takeover
  • Privilege escalation to admin role
  • Encryption key compromise
High
3 months free

3 months free on any Mizu CRM paid plan of your choice.

  • Cross-site scripting (XSS) with significant impact
  • Cross-site request forgery (CSRF)
  • Insecure direct object reference (IDOR)
  • Sensitive data disclosure (PII, credentials)
  • Logic flaws causing unauthorized data access
  • Unvalidated open redirects on auth pages
Medium
2 months free

2 months free on any Mizu CRM paid plan of your choice.

  • Reflected XSS with limited exploitability
  • Broken authentication (not actively exploited)
  • Sensitive data exposure (non-PII)
  • API rate limiting bypass enabling abuse
  • Session fixation vulnerabilities
  • Significant missing security headers
Low
1 month free

1 month free on any Mizu CRM paid plan of your choice.

  • Outdated third-party dependencies (with exploitability evidence)
  • Non-critical missing security headers
  • Weak password policy edge cases
  • Non-sensitive information disclosure
  • Broken links on security-related pages
  • Typos or errors in security documentation

Eligibility

Who can participate

  • Must be 18 years of age or older
  • Not a current Mizu CRM employee or contractor
  • No criminal convictions related to computer fraud in the past 5 years
  • Not subject to applicable trade sanctions or export controls
  • Must operate in good faith without causing service disruption

Who cannot participate

  • Current employees and direct contractors of Mizu CRM
  • Immediate family members of current employees
  • Individuals from countries subject to international sanctions
  • Researchers with prior undisclosed findings still under review
  • Anyone who has violated the program rules in the past

Scope

In scope

  • app.mizucrm.com production application
  • api.mizucrm.com REST and GraphQL APIs
  • mizucrm.com and all subdomains
  • iOS and Android mobile applications
  • Third-party OAuth integrations and API key handling
  • Authentication and authorization systems
  • Injection attacks (SQL, NoSQL, LDAP, OS command)
  • XSS, CSRF, XXE, SSRF, and API security flaws
  • Broken access control and business logic flaws
  • Security misconfiguration and cryptographic failures

Out of scope

  • Social engineering or phishing attacks against employees
  • Physical security breaches or on-site testing
  • Denial of service (DoS) or load testing
  • Brute force attacks (without demonstrating impact)
  • Rate limiting without additional security impact
  • Missing security.txt file
  • Email authentication misconfiguration (SPF/DKIM/DMARC) without impact
  • Outdated software versions without evidence of exploitability
  • Features or endpoints not yet released to production
  • Vulnerabilities in third-party software not in our control
  • Previously reported or publicly known exploited vulnerabilities

Submission process

Submit via HackerOne (preferred) or Intigriti. Email fallback for urgent disclosures only.

Response & reward timeline

1
Day 1

Initial acknowledgment of your report

2
Days 1-3

Vulnerability assessment and severity classification

3
Days 3-7

Fix development and internal code review

4
Days 7-14

Testing, staging deployment, and verification

5
Day 14+

Production deployment, reward issued, coordinated disclosure

Report template

## Vulnerability Report

### Title
[Clear, descriptive title e.g., "IDOR on /api/users allows reading other accounts"]

### Severity
Critical / High / Medium / Low

### Affected Component
[URL, API endpoint, or feature e.g., GET /api/v1/contacts/:id]

### Vulnerability Type
[XSS, SQLi, CSRF, IDOR, Authentication bypass, etc.]

### Description
[Detailed explanation of the vulnerability and how it occurs]

### Steps to Reproduce
1. Authenticate as a standard user
2. Navigate to [URL]
3. Modify [parameter] to [value]
4. Observe [result]

### Proof of Concept
[Safe PoC code, curl command, or annotated screenshots]

### Impact Assessment
[What can an attacker achieve? What data is at risk? How many users affected?]

### Remediation Suggestion (optional)
[Your suggested fix or mitigation]

### Responsible Disclosure Confirmation
- [ ] I will not disclose this vulnerability publicly before coordinated disclosure
- [ ] I understand and accept the 90-day disclosure window
- [ ] I am acting in good faith within program scope
- [ ] I have not accessed data beyond what is needed to demonstrate the issue

How to redeem your reward

Rewards are issued as unique subscription codes via email within 5 business days of fix deployment.

Subscription reward steps

  1. 1We verify and close your report as valid
  2. 2We email you a unique subscription code within 5 business days of fix deployment
  3. 3You redeem the code at mizucrm.com/redeem no existing account required
  4. 4Your free months are applied immediately to a new or existing account
  5. 5Critical tier researchers also receive a separate coupon code for future plan discounts

Coupon codes (Critical only)

Critical-severity researchers receive a discount coupon in addition to 3 free months. The coupon is valid for any paid plan renewal or upgrade and is issued alongside your subscription code.

Coupons are single-use, non-transferable, and valid for 12 months from date of issue.

Legal safe harbor

Mizu CRM will not pursue legal action against researchers who discover and report security vulnerabilities in good faith, following these program rules, within the defined scope.
  • Do not access, modify, or delete data beyond what is strictly necessary to demonstrate the vulnerability.
  • Do not disrupt services, perform denial of service, or degrade system performance for other users.
  • Do not disclose the vulnerability publicly before the 90-day coordinated disclosure window.
  • Do not exploit vulnerabilities for personal gain or share access with third parties.
  • Follow all applicable laws and regulations in your jurisdiction.
  • Act in good faith research is for improving security, not competitive intelligence.

Recognition

Hall of Fame

All researchers who submit valid, accepted reports are invited to be listed in our public Hall of Fame regardless of whether they redeem their subscription reward. Recognition is permanent and updated per accepted report.

View recognized researchers

Support channels

HackerOne portal

Primary submission channel

Initial response within 24 hours

security@mizucrm.com

Program questions and edge cases

Response within 24-48 hours

enterprise-security@mizucrm.com

Critical or zero-day disclosures

Response within 2 hours

FAQ

Do I need to be a Mizu CRM customer to receive a reward?

No. When we issue your reward code, you can redeem it to create a brand new account. You do not need an existing subscription.

Can I choose which paid plan my free months apply to?

Yes. The subscription code works on any paid plan Starter, Professional, or Enterprise. You choose at redemption.

What does the coupon code for Critical findings cover?

Critical tier researchers receive a discount coupon in addition to 3 free months. The coupon gives a percentage discount on any paid plan renewal or upgrade. The exact percentage is shown on the coupon at time of issue.

Can I stack the free months with an existing subscription?

Yes. If you already have a paid plan, the free months are added to your next billing cycle effectively pausing your billing for that period.

Can I test on a staging environment?

Yes. Request temporary staging access by emailing security@mizucrm.com. Include your HackerOne profile and the area you intend to test.

What happens if my report is a duplicate?

The first researcher to submit a valid, complete report receives the reward. Duplicate reports will be acknowledged and closed with an explanation.

Can I dispute a severity classification?

Yes. If you believe your finding has been under-classified, submit a reassessment request within 5 business days with additional impact evidence.

Can I be listed in the Hall of Fame without redeeming a reward?

Yes. Recognition in the Hall of Fame is separate from reward redemption. You can decline the subscription reward and still be listed.

Ready to submit a report?

Find a vulnerability, report it responsibly, and earn free Mizu CRM subscription months. Primary submission is via HackerOne.

Thank you for helping us build a more secure product for our customers.

    Bug Bounty Program Mizu CRM Security