Disclaimer: This report reflects the submitter's account. It has not been independently verified unless marked Verified. The company may dispute this claim.
Scam Alert: acceptmission.com — 8 Months of Complete Silence After Multiple Valid Security Reports
Company / Program: acceptmission.com
Platform: Self-Hosted · Severity: high · Scam type: ignored
Published:
Reported by: anonymous
On December 1, 2025, I responsibly disclosed multiple security vulnerabilities to the AcceptMission bug bounty program. All reports were submitted through their official disclosure process.
The reported vulnerabilities included:
* 3 Stored HTML Injection vulnerabilities
* 1 Stored Cross-Site Scripting (Stored XSS) vulnerability
* Race Condition vulnerability
* Broken Link Hijacking vulnerability
* Rate Limit vulnerability
Despite following responsible disclosure practices, I have not received a single response from the company.
Since the reports were submitted, there has been:
* No acknowledgment
* No triage
* No request for additional information
* No status update
* No bounty decision
* No communication of any kind
More than eight months have now passed, and every report remains unanswered.
Responsible disclosure relies on communication between security researchers and organizations. Even if a report is determined to be out of scope, informative, or a duplicate, researchers deserve a response within a reasonable timeframe. Complete silence is not an acceptable way to manage a bug bounty program.
This article documents my personal experience with the AcceptMission bug bounty program. The purpose is to provide transparency for other security researchers considering participating in the program.
To be clear, I am not claiming that every reported vulnerability was valid or eligible for a bounty. Since the company has never reviewed or responded to the reports, no determination has been communicated. The issue highlighted here is the complete lack of communication after multiple responsible disclosures.
If AcceptMission reviews the reports or provides any response in the future, this article will be updated accordingly.
Researchers invest significant time identifying and responsibly reporting security issues. The least a bug bounty program should provide is timely communication. After more than eight months, AcceptMission has failed to provide even a single response.
Disclosure Date: December 1, 2025
Current Status: No response after more than eight months.