Constant Contact, Inc.

  • Partial safe harbor

We no longer offer point rewards for submissions on this program. Please refer to our blog post: How Bugcrowd sees VDPs and points for more details.

Program stats

  • Vulnerabilities accepted 670
  • Validation within 3 days 75% of submissions are accepted or rejected within 3 days

Latest hall of famers

Recently joined this program

805 total


Please note: This program or engagement does not allow disclosure. You may not release information about vulnerabilities found in this program or engagement to the public.

At Constant Contact the safety, privacy, and security of the data our customers entrust to us is very important to us. We welcome the reporting of security vulnerabilities in our product and services and encourage researchers to reach out to us when they find issues


We operate under the concept of responsible disclosure and require any researcher to follow the following process:

  • The researcher shares the issue with us first before he or she shares it publicly
  • We get a reasonable amount of time to address the issue before the researcher makes the information public
  • The researcher provides all the details to validate and reproduce the issue
  • The researcher makes a good faith effort to avoid impacting the service or the data contained in it
  • The researcher must not violate any laws

There are some things we explicitly ask you not to do:

  • When experimenting, please use only test accounts you control.
  • Do not run automated scans without checking with us first.
  • Do not test the physical security of our offices
  • Do not test using social engineering techniques
  • Do not perform DoS or DDoS attacks.
  • In any way disrupt our customers


To sign-up to participate, please head over to

Security is a constantly evolving field and we enjoy collaborating with the best and brightest in the security community. We always appreciate your taking the time to help us find and fix security flaws so they don't pose a serious risk to our customers.

Report Formatting

In the Description of a Vulnerability Report, please format the replication process as an Ordered List. Valid reports, formatted the following way, will be prioritized and accepted faster by Newfold Digital:

Steps To Reproduce: (Add details for how we can reproduce the issue)

  1. [add step 1]
  2. [add step 2]
  3. [add step 3]...


Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please submit through the Bugcrowd Support Portal. We will address your issue as soon as possible.

Learn more about Bugcrowd’s VRT.

This program follows Bugcrowd’s standard disclosure terms.