diff --git a/docs/internals/bug-bounty.mdx b/docs/internals/bug-bounty.mdx
index b823e6246..c5bc8b39e 100644
--- a/docs/internals/bug-bounty.mdx
+++ b/docs/internals/bug-bounty.mdx
@@ -41,7 +41,7 @@ All final reward amounts are determined at Infisical's discretion based on impac
 
 ### Out of Scope
 
-- Social engineering or phishing
+- Social engineering or phishing (including email hyperlink injection without code execution)
 - Rate limiting issues on non-sensitive endpoints
 - Denial-of-service attacks that require authentication and don't impact core service availability
 - Findings based on outdated or forked code not maintained by the Infisical team
@@ -57,4 +57,4 @@ We ask that researchers:
 - Use testing accounts where possible
 - Give us a reasonable window to investigate and patch before going public
 
-Researchers can also spin up our [self-hosted version of Infisical](/self-hosting/overview) to test for vulnerabilities locally. 
\ No newline at end of file
+Researchers can also spin up our [self-hosted version of Infisical](/self-hosting/overview) to test for vulnerabilities locally.