Work at SimpliSafe Managed Bug Bounty Engagement? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.
Ask BugRater to submit itPrivate. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Reviews
0 publishedNo reviews yet.
Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 19 Sep 2026.
SimpliSafe's mission is to make every home secure. Delivering on that means putting our customers at the center of everything we do to improve their safety and comfort. Our home security solutions are designed with cutting-edge technology yet are affordable to purchase, easy to install and don’t require contracts. We protect more than four million people throughout the United States and the United Kingdom against everything from intruders to fires, water damage and more. As part of our commitment to our customers, we take data privacy and security issues very seriously. By engaging with talented security researchers across the globe through programs like Bugcrowd, SimpliSafe can more effectively identify and resolve suspected vulnerabilities. Thank you for participating in our program and helping protect SimpliSafe and its customers from potential threats. Now Public in September 2025! We are excited to have this program open to the public. In these first weeks, we expect increased activity, so please keep these in mind while testing our targets: Use an account tied with your @bugcrowdninja.com email for all testing. We will block and restrict suspicious activity from other accounts. Submissions that involve other email addresses will be marked as Out of Scope. The auth.simplisafe.com subdomain handles authentication and is owned by Auth0. Since SimpliSafe doesn’t own the system, it is Out of Scope for testing and suspicious activity will be blocked. Normal behavior with this system is expected as part of testing. Be a good neighbor while testing our systems and refrain from activities that could affect system availability. We're co-workers now, so let's be kind to each other. If you have any questions about our systems or want to know more information to help test, feel free to reach out to support and they can pass the questions along. Thanks for joining us in our bug bounty program! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Good luck, and happy hunting!
Scope
31 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.prd.aser.simplisafe.com | api | ✓ bounty | not set |
| *.prd.cam.simplisafe.com (App Endpoints) | api | ✓ bounty | not set |
| *.prd.cam.simplisafe.com (HSP Endpoints) | api | ✓ bounty | not set |
| *.prd.platform.simplisafe.com (App Endpoints) | api | ✓ bounty | not set |
| *.prd.platform.simplisafe.com (HSP Endpoints) | api | ✓ bounty | not set |
Show all 31 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.prd.services.simplisafe.com (App Endpoints) | api | ✓ bounty | not set |
| *.prd.services.simplisafe.com (HSP Endpoints) | api | ✓ bounty | not set |
| *.prd.webapps.simplisafe.com | api | ✓ bounty | not set |
| api.prd.commerce.simplisafe.com | api | ✓ bounty | not set |
| api.services.simplisafe.com (App Endpoints) | api | ✓ bounty | not set |
| api.services.simplisafe.com (HSP Endpoints) | api | ✓ bounty | not set |
| api.simplisafe.com (App Endpoints) | api | ✓ bounty | not set |
| api.simplisafe.com (HSP Endpoints) | api | ✓ bounty | not set |
| bb1.simplisafe.com | api | ✓ bounty | not set |
| bb2.simplisafe.com | api | ✓ bounty | not set |
| cb.simplisafe.com | api | ✓ bounty | not set |
| media.simplisafe.com | api | ✓ bounty | not set |
| mfa.simplisafe.com | api | ✓ bounty | not set |
| SimpliSafe Customer Android App | android | ✓ bounty | not set |
| SimpliSafe Customer iOS App | ios | ✓ bounty | not set |
| SimpliSafe Customer Webapp - UK | website | ✓ bounty | not set |
| SimpliSafe Customer Webapp - US | website | ✓ bounty | not set |
| SimpliSafe Website - UK | website | ✓ bounty | not set |
| SimpliSafe Website - US | website | ✓ bounty | not set |
| auth.simplisafe.com | api | out | not set |
| careers.simplisafe.com | website | out | not set |
| clicks.simplisafe.com | website | out | not set |
| library.simplisafe.com | website | out | not set |
| livechat.simplisafe.com | website | out | not set |
| press.simplisafe.com | website | out | not set |
| support.simplisafe.com | website | out | not set |