Effective date: 2026-11-11.
Hookdeck welcomes security researchers who help protect our customers and their event data. This program explains how to report a vulnerability, test safely, and qualify for a bounty.
We welcome security reports at every severity. Cash rewards are available for eligible critical, high, and medium-severity vulnerabilities in the systems listed below.
Report a vulnerability
Email security@hookdeck.com with the subject Security report: [short description].
Please include:
- The affected hostname, endpoint, or feature.
- A short explanation of the vulnerability and its demonstrated security impact.
- Written steps to reproduce it, including required permissions, account setup, and configuration.
- Redacted requests, responses, screenshots, or a small proof of concept that supports your findings.
- The approximate time of testing and identifiers for test accounts or organizations you control.
For bounty consideration, include a working proof of concept (PoC) and a reproducible demo that shows the vulnerability and its actual security impact.
You may attach screenshots, recordings, and proof-of-concept files. Videos should supplement written reproduction steps. For evidence too large or sensitive to email, contact us first so we can arrange an appropriate transfer method. Keep evidence off public hosting services.
Replace live credentials with placeholders and use synthetic event data. Please do not send customer payloads, unrelated personal information, or production API keys. Reply to the same email conversation with updates.
Systems you may test
The following targets are in scope, subject to the testing rules below:
| Target | Permitted testing |
|---|---|
dashboard.hookdeck.com | Event Gateway dashboard, using test accounts and organizations you control |
api.hookdeck.com | Public API, using your own test accounts, API keys, and resources |
console.hookdeck.com | Console functionality and Test URLs you create, using synthetic data |
outpost.hookdeck.com | Hookdeck-managed Outpost, using your own deployments and test tenants |
| Hookdeck-issued Outpost deployment URLs | Your own Hookdeck-managed deployment and test tenants only |
api.outpost.hookdeck.com | Hosted Outpost API, using your own API keys, deployments, and tenant resources |
| Hookdeck-issued Event Gateway source URLs | Only source URLs belonging to test organizations you control |
Reports may also identify vulnerabilities in Outpost's shared server implementation that affect Hookdeck-managed Outpost. Include the affected version and demonstrate the impact using resources you control.
Only these targets are authorized by this policy. Other Hookdeck domains, internal infrastructure, development environments, and third-party or self-hosted deployments are outside the authorized testing scope unless we authorize testing in writing. Coverage of Outpost's implementation does not authorize testing someone else's deployment.
Customer-operated destinations, websites, and third-party services are outside scope, even when reachable through Hookdeck. Use destinations you control when testing event delivery.
If you are unsure about a target or testing method, email us before proceeding. You may still report a suspected issue outside this scope; doing so does not authorize further testing of that system.
Test safely
- Use accounts, organizations, sources, destinations, and data you control. Demonstrate an organization-isolation issue between two test organizations you own.
- Perform only the testing needed to establish the issue. Keep traffic volumes low and stop if your activity affects service availability.
- Do not conduct denial-of-service attacks, flooding, bulk account creation, credential guessing, phishing, social engineering, or physical attacks.
- Do not alter or delete other users' data, establish persistent access, deploy malware, or use a finding to access additional systems.
- If you unexpectedly encounter another person's data or credentials, stop that test immediately and notify us. Describe the exposure without retrieving additional records or sending the sensitive contents.
We can assess broader impact from a limited demonstration; you do not need to cause broader harm to prove severity.
Findings we prioritize
We are particularly interested in vulnerabilities that allow:
- Access to another organization's event payloads, credentials, or configuration.
- Authentication bypass, unauthorized account access, or privilege escalation.
- Unauthorized replay, modification, deletion, or delivery of another organization's events.
- Access beyond the intended boundaries of transformations or server-side network requests.
We assess the security boundary crossed and the impact you demonstrate, including the access and interaction needed to exploit the issue.
Out of scope and not covered
Without demonstrated security impact, the following are generally ineligible:
- Scanner alerts, dependency advisories, or hypothetical attack chains without evidence of an affected, reachable behavior.
- Missing security headers, software version disclosure, or recommendations to follow a best practice.
- Information that is already public or does not expose sensitive data.
- Actions that only affect your own account through permissions or functionality intentionally provided to it.
- Normal product bugs, availability complaints, or support requests.
We may still investigate these reports. A report being ineligible for payment does not by itself mean the research was improper.
Reports about mail transfer agent (MTA) records are out of scope, are not eligible for a bounty, and will be automatically closed.
Current Hookdeck employees and contractors, and findings discovered through paid work for Hookdeck, are not eligible for this program's rewards.
AI-assisted research
You are welcome to use AI and automated tools. Verify the finding before submitting it, explain your testing, and distinguish observed results from assumptions. Tool output or an AI-generated explanation alone is insufficient evidence for a bounty. A concise report with a working demonstration is more useful than a long speculative analysis.
Rewards and eligibility
Our initial rewards are in USD:
| Severity | Reward |
|---|---|
| P1 — Critical | $1,500 |
| P2 — High | $1,000 |
| P3 — Medium | $500 |
| P4/P5 — Low or informational | Reviewed; no cash reward in the initial program |
Bounties require a working proof of concept (PoC) and a reproducible demo of the vulnerability and its actual security impact. We do not award bounties for hypothetical scenarios, speculative attack chains, or unverified claims. Hookdeck determines severity after validation, considering demonstrated impact, exploitability, prerequisites, and affected users. Eligible reports receive the reward listed for their assessed severity. We will explain our assessment.
To qualify, a report must identify a previously unknown vulnerability in an in-scope target, provide enough evidence for validation, and arise from testing consistent with this policy. You may ask us to reconsider an assessment by replying with additional evidence.
For duplicate findings, we generally reward the first report containing enough information to validate the issue. Multiple symptoms or endpoints with the same underlying cause generally receive one award. A distinct vulnerability or materially different impact will be assessed separately.
Payment
Payment is subject to applicable legal requirements and any necessary payment or tax information. We aim to pay approved rewards within 30 calendar days after receiving the required details. Providing a fix is optional, and payment does not require waiting for deployment of a fix.
What to expect from us
We aim to:
- Provide a first response within two business days.
- Prioritize reports suggesting critical impact or active exploitation.
- Update active investigations at least weekly, including when we need more information.
- Explain the outcome, severity assessment, and reward decision.
An acknowledgment confirms receipt; validity and reward eligibility are determined through investigation. Complex findings may take longer to assess or resolve. If we cannot reproduce a finding, we will describe what information would help us continue.
We treat reports as confidential and limit access to people and service providers who need them for investigation, remediation, or payment. We will ask your permission before publicly crediting you.
Coordinated disclosure
Please keep vulnerability details private while we investigate and work with us on a publication date. Our default coordination window is 90 calendar days from the initial report. We may agree on earlier disclosure after remediation, or a longer period when necessary; extensions require agreement with you.
Give us at least seven calendar days' notice before planned publication so we can coordinate communication and customer protection. Public write-ups must omit customer data, live credentials, and other people's private information.
Protection for good-faith research
We authorize research on the listed targets when its purpose is to identify and report security weaknesses, it follows these testing boundaries, and it is conducted with reasonable care to avoid harm.
Hookdeck will not initiate or support legal action against you for research covered by this policy. To the extent necessary for that research, we waive conflicting restrictions in our terms of service. This protection is independent of whether a finding is confirmed or receives a bounty.
If you make an unintended mistake, stop the affected activity and tell us promptly. We will assess the circumstances in good faith; an accidental deviation does not automatically remove this protection.
This authorization covers Hookdeck's systems only. We cannot authorize access to third-party systems or bind other parties. If a third party challenges research covered by this policy, we will clarify that Hookdeck authorized it.
Program changes
We may update the scope, rewards, or program terms by publishing a revised policy. Changes apply going forward. Reports submitted before a change will be assessed under the policy in effect when submitted, and protection for research already covered will not be withdrawn retroactively.
For reports or questions, contact security@hookdeck.com.