Bug Bounty Hall of Fame
Hall of fame
Our thanks to the following security researchers for their submissions under our bug bounty program:
2026
| Researcher | Vulnerability found | Bounty paid |
| Ahmed Saeed | Missing calendar ACL checks and Cyrus memory mismanagement | $3750 |
| Renaldas Ivanauskas | Android app credentials vulnerability | $2000 |
| Lyra Rebane (rebane2001) | CSS sanitisation bypasses | $2000 |
| interpolwantme | OAuth redirect URI verification bypass | $2000 |
| Ryoga Hosojima (Ryoga.exe) | Image blocking bypasses in emails | $750 |
| Miro Hatachi | Email authentication bypass | $400 |
| Md Ohidul Islam | Step-up authentication bypass | $250 |
| Ahmed Saeed | Email identity verification bypass | $200 |
| Ahmed Saeed | Internal metrics leak | $200 |
| Thomas Johnson (MailRoute) | ARC Authentication-Results forgery | $200 |
| Bug Raiders (JAC) | Sensitive action reauthentication bypasses | $200 |
| Ahmad Alassaf | Authentication-Results forgery | $200 |
| Jakub Kozub | DMARC enforcement bypass | $150 |
| Md Ohidul Islam | DMARC enforcement bypass | $150 |
| Md Ohidul Islam | Authentication header metadata forgery | $100 |
| Marish Pasco | External link protection bypass | $100 |
| M. Enes Aydın | External link protection bypass | $100 |
| Miro | BIMI Validation issue | $100 |
| Bug Raiders (JAC) | Trial abuse prevention bypass | $100 |
| Jubril Busari (Jaybeepy) | Trial abuse prevention bypass | $100 |
| Ooriime | Step-up authentication bypass for auto-bcc only | $100 |
| 0xEr3n | Quoted reply CSS containment bypass | $100 |
| 0xEr3n | External link protection bypass | $100 |
2025
| Researcher | Vulnerability found | Bounty paid |
| Lyra Rebane (rebane2001) | Multiple CSS sanitisation bypasses | $3500 |
| Mohsin Ali | Topicbox firewall misconfiguration | $500 |
| Kurachan | Address parsing inconsistencies | $250 |
| Jaikishan Tulswani | Internal documentation leak | $200 |
| Hao Wang & Caleb Sargent | DMARC bypass | $100 |
| Abdullah Shittu (LegaciesofLekan) | Internal metrics leak | $100 |
2024
| Researcher | Vulnerability found | Bounty paid |
| Amethama Luturmas | Topicbox ACL bypass | $100 |
2023
| Researcher | Vulnerability found | Bounty paid |
| Mohammad Eldawody | Fastmail 2FA vulnerability | $3000 |
| Max Raams | Email authentication weaknesses | $250 |
2022
| Researcher | Vulnerability found | Bounty paid |
| Vivek Kumar Yadav | Topicbox app vulnerability | $100 |
| Vivek Kumar Yadav | Android app vulnerability | $100 |
| Milan Jain | CRLF injection vulnerability | $250 |
| Ilkin Javadov | Pobox password link expiry | $100 |
| Huzaifa Muhammad | Topicbox mobile app vulnerability | $100 |
| Huzaifa Muhammad | Anti-abuse bypass on mobile app | $100 |
| Jonathan Page | DKIM oversigning | $200 |
2021
| Researcher | Vulnerability found | Bounty paid |
| Dennis Trappe | iOS app vulnerability | $100 |
| Sheikh Rishad | Android app vulnerability | $100 |
| Jaikishan Tulswani | Access vulnerability for third party service | $250 |
| Mohammed Eldawody | Bypass security screen in Topicbox | $100 |
| Vicky Sahputra | Deleted group vulnerability in Topicbox | $100 |
| Markus Holtermann | Fingerprint authentication vulnerability in Fastmail app | $100 |
| N Krishna Chaitanya | Password reset vulnerability in Pobox | $100 |
| Pravas Ranjan Kanungo | Image proxy vulnerability in Fastmail | $100 |
| Mohammed Eldawody | Password recovery bug in Pobox | $3000 |
| Roman Zabaluev | Caching of “don’t require 2FA again on this device” cookie validity | $500 |
2020
| Researcher | Vulnerability found | Bounty paid |
| Mohammed Eldawody | Privilege escalation bugs in Topicbox | $2000 |
| Mohammed Eldawody | Bypass security screen in Topicbox | $200 |
| Daniel Santos | Mutation bypass in DOMPurify | $100 |
| Michał Bentkowski (Securitum) | CSS sanitisation bypass | $750 |
| Michał Bentkowski (Securitum) | DOMPurify mXSS (sponsored bug bounty; did not affect Fastmail products) | $250 |
| Mohammed Eldawody | Stored XSS in Pobox | $200 |
| Mart Gil Robles | Login CSRF in Pobox | $100 |
| Basavaraj Banakar | Self-XSS in Pobox | $100 |
| Alexander Harkness | Unnecessary information disclosed in DMARC report | $100 |
| Jackson K V | Login rate-limiting bypass in Pobox | $200 |
| Sachin Hodkasia | Login rate-limiting bypass in Pobox | $200 |
| Sachin Hodkasia | Password reset expiration issue in Pobox | $100 |
| Syed Muhammad Asim | Mixed content warnings in Pobox | $100 |
2019
| Researcher | Vulnerability found | Bounty paid |
| Ace Candelario | HTML injection vulnerabilities in Pobox | $100 |
| Hemant Singh Manral | Limited reuse of expired recovery options | $250 |
| Joran Dirk Greef (Ronomon) | AppCache exploit to compromise attachment downloads | $3500 |
| Michał Bentkowski (Securitum) | DOMPurify mXSS (sponsored bug bounty; did not affect Fastmail products) | $500 |
| Joran Dirk Greef (Ronomon) | Bypasses to allowed attachment extensions | $200 |
| Devansh Batham (Infoziant Labs) | Deauthentication issue in Pobox | $100 |
| Devansh Batham (Infoziant Labs) | Password reset design issue in Pobox | $100 |
| Brian Hyde | HTML injection and email address injection vulnerabilities in Pobox | $400 |
| Jaikishan Tulswani | Session invalidation logic error in Pobox | $100 |
| Aman Mahendra | Race condition in 2FA login in Pobox | $100 |
| Devansh Batham (Infoziant Labs) | Miscellaneous CSRF vulnerabilities in Pobox | $500 |
| Devansh Batham (Infoziant Labs) | Request replay issue in Pobox | $200 |
| Anonymous | Incomplete access control restrictions on shared file storage within an account | $1000 |
| Aakash Kumar | Recovery code logic error in Pobox | $100 |
2018
| Researcher | Vulnerability found | Bounty paid |
| Devansh Batham (Infoziant Labs) | Password reset logic error in Pobox | $100 |
| Ahmed Elsobky | Phishing protection bypass | $100 |
| Tarun Mahour | Self-XSS in Pobox | $100 |
| Devansh Batham (Infoziant Labs) | CSRF vulnerabilities in Listbox | $200 |
| Anonymous | Network misconfiguration | $2000 |
| Nikola Kojic | Image proxy bypass | $100 |
| Jaikishan Tulswani | Page invalidation logic error in Pobox | $100 |
| Jaikishan Tulswani | Private services discovered | $100 |
| Jaikishan Tulswani | Session invalidation logic error in Listbox | $100 |
| Jaikishan Tulswani | List name discovery in Listbox | $100 |
| Aman Mahendra | Self-XSS in Listbox | $100 |
| Arsiadi Sriyanto | CSRF Token Disclosure | $100 |
| Aman Mahendra | XSS in Listbox | $200 |
| Jaikishan Tulswani | Page invalidation logic error | $100 |
| Jaikishan Tulswani | DNS misconfiguration | $200 |
| Jaikishan Tulswani | Open redirect in Listbox | $100 |
| Jaikishan Tulswani | Access control bypasses in Listbox | $700 |
| Jaikishan Tulswani | Multiple XSS and CSRF vulnerabilties in Listbox | $1000 |
| Aman Mahendra | links to insecure HTTP URLs provided in Listbox | $100 |
| Jaikishan Tulswani | CSRF in Listbox | $100 |
| Jaikishan Tulswani | subscription limit bypass in Listbox | $300 |
| Jaikishan Tulswani | access control bypass in Listbox | $100 |
| Ranjit Pahan | stored XSS in Listbox | $200 |
| Devansh Batham (Infoziant Labs) | UI redressing attack on Listbox and Pobox | $100 |
| Devansh Batham (Infoziant Labs) | Multiple XSS and CSRF vulnerabilities in Listbox and Pobox | $1200 |
| Brian Hyde | Multiple XSS and CSRF vulnerabilities in Listbox and Pobox | $1000 |
| Jaikishan Tulswani | XSS in Listbox | $200 |
| Bijan Murmu | Lax password policy in Listbox | $200 |
| Ranjit Pahan | window.opener phishing vulnerabilty with attachments | $100 |
| Chachi | Error in check preventing reuse of previous password | $100 |
| Jaikishan Tulswani | Session invalidation logic error | $100 |
| Jaikishan Tulswani | Referrer leakage from support ticket | $100 |
| Alex Zorin | Input truncation bypassing domain validation | $100 |
2017
| Researcher | Vulnerability found | Bounty paid |
| Max Justicz | Write access to server files | $4000 |
| Brian Hyde | Read-only access to private server files | $2000 |
| Arsiadi Sriyanto | Read access to private file storage metadata | $500 |
| Lucas Reddinger | Missing “enabled” check for shared calendar link | $500 |
| Bastian Welfrid Purba | CSRF in support ticket creation | $250 |
| Nikola Kojic | Image proxy bypass | $200 |
| Arsiadi Sriyanto | XSS on DAV subdomains | $200 |
| pnig0s | Unexploitable SSRF | $100 |
2016
| Researcher | Vulnerability found | Bounty paid |
| Arsiadi Sriyanto | Reflected XSS | $1500 |
| Brian Hyde | Server Side Request Forgery | $1000 |
| Shiv Bihari Pandey | Security settings unlock bypass | $500 |
| John Cleary | Incorrect CalDAV ACL check allowed access to list of unrelated users | $500 |
| Richard Smith | 2FA bypass when importing a user into a business | $300 |
| Shiv Bihari Pandey | SMS verification bypass | $250 |
| n00b 4lw4y5 7ry | Open redirect | $100 |
2015
| Researcher | Vulnerability found | Bounty paid |
| Salman Niksefat | XSS in email body (classic interface or old browsers only) | $1500 |
| Bogdan Calin | HTTP header injection | $500 |
| James Kettle (PortSwigger Web Security) | Login CSRF | $100 |
| Hugh Davenport | Deletion of contacts/events with restricted logins | $100 |
| Hugh Davenport | window.opener phishing vulnerabilty in classic interface | $100 |
2014
| Researcher | Vulnerability found | Bounty paid |
| Sergey Markov | Read-only access to private server files | $2000 |
| Thomas Guittonneau | Read-only access to private server files | $2000 |
| Sergey Markov | HTTP header injection | $1000 |
| Frans Rosén | XSS in email (classic interface only) | $1000 |
| Prashant Sharma | Stored XSS in our support ticket system | $1000 |
| Hammad Shamsi | Stored XSS in our support ticket system | $1000 |
| Bastian Welfrid Purba | Missing user privilege check for removing user websites | $1000 |
| Bastian Welfrid Purba | Missing user privilege check for fetching saved searches | $250 |
| Satish Bommisetty | Can trick user into making phone call in iOS app | $200 |
| Bastian Welfrid Purba | 4 self-XSS issues (not exploitable) | $400 |
| V. Harish Kumar | 2 self-XSS issues (not exploitable) | $200 |
| Ranjeet Singh | IMAP connections not immediately killed on password change | $100 |
| Sasi Levi | Self-XSS issue (not exploitable) | $100 |
| Manikandan Rajakumar | Self-XSS issue (not exploitable) | $100 |
| Lyon Yang | XSS in embedded image in email body (only classic interface, only IE6, only if remote images enabled) | $100 |
| Jakub Zoczek | HTTP header injection (only on redirect) | $100 |
| Rakesh Mane | Self-XSS issue (not exploitable) | $100 |
| Sasi Levi | CSRF on some business/family account admin actions | $100 |
| Sasi Levi | CSRF on some folder sharing actions | $100 |
| Hammad Shamsi | Open redirect in paypal handler | $100 |
| Mike Cardwell | Image proxying bypass on reply | $100 |
| Anonymous | window.opener phishing vulnerabilty | $100 |
