← All programs
PublicCommunicationsSelf-triagedSafe harborfull disclosure
Nimbus Mail
Encrypted email and calendar for 9M privacy-focused users.
Escrowed · $380klaunched 10 Oct 2023
pgn scope pull nimbus-mail
Submit report Response, measured
last 90 daysMedian triage
8h
commitment 24h
Median to bounty
5d
commitment 10d
Queue right now
3
133 received · 57 resolved
Response score
97%
within commitment
Triage: median vs commitment8h / 24h
Bounty: median vs commitment5d / 10d
Escrow
$380,000
Held by Peregrine, released automatically on resolution. Covers 8 critical payouts at top of band.
Paid all-time
$1.69M
Hunters thanked
187
Bounty table
- critical$12k – $45k
- high$4,000 – $12k
- medium$1,000 – $4,000
- low$250 – $1,000
Bands are floors and ceilings the program is held to. Mediation can move a report within a band, never below the floor of its agreed severity.
Scope · 4 assets
signed · diff feed available| Asset | Type | Max severity | Eligible | Note |
|---|---|---|---|---|
| mail.nimbus.example | web | critical | yes | Web client |
| api.nimbus.example | api | critical | yes | JMAP and bridge APIs |
| Nimbus Bridge | desktop | high | yes | IMAP/SMTP bridge |
| github.com/nimbusmail/crypto | source | critical | yes | Open-source crypto library |
Out of scope
- Metadata leakage already described in the threat model
- Email spoofing to Nimbus addresses from external domains
Policy
Plaintext recovery of another user's message content is Critical. Cryptographic findings are reviewed by the crypto team within 24 hours.
#e2ee#jmap#cryptography
Recent reports · 2
Filter hacktivity →- highPGN-10457
JMAP blob download ignores mailbox ACL for shared calendars
Attachments on events in a calendar shared read-only could be fetched by blob id after the share was revoked.
$11,000Resolved - lowPGN-10368
Bridge IMAP IDLE handler accepts unauthenticated NOOP that resets rate limiter
Accepted at Low with a demonstrated 10x increase in login attempts per minute against a researcher account.
@ptr_nullImproper Restriction of Excessive Authentication Attempts22 Sept 2026triage 4.3hresolved 2.9d$600Resolved