kaufland.de - Kaufland e-comme Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Requirements for reward:

1. You are the first person to report the corresponding security vulnerability, it is clearly within the scope of the program as defined by our program description* and has been accepted by our security team triage process.

2. You must create a detailed report with technical details of the vulnerability, associated risk, and the potential impact on our products and/or our users, as well as recommendation on the remediation we should implement.

3. Your report must include written instructions on how to reproduce the vulnerability. Reports that do not include clear reproduction steps may be excluded from the premium.

4. Kaufland.de should have sufficient time to react and correct the error. The issue must not be disclosed publicly before our security team has communicated that the issue has been fixed. You confirm that you have not informed any third parties about the vulnerability.

5. You confirm that you have not exfiltrated or disclosed any Kaufland or third-party data, especially those which belong to the customers of Kaufland.de.

Testing Requirements:

Nothing is allowed that
- could lead to denial of service and/or
- could change behavior of our sites and/or
- could change content of our sites.

It is not allowed
- to publish findings outside openbugbounty.org,
- to use findings/insights for other than the purpose to inform us

Rules of the road
- Please use scanners in a responsible way in terms of volume and avoid spamming the contact form https://www.kaufland.de/kontakt/*
- Please do NOT attempt to access data of our customers: instead, use your own accounts for such tests
- Please do NOT attempt to pivot/escalate privileges in case you gained some access to our systems. You probably have already achieved the highest bounty
- Social engineering or other attacks on our employees are out of scope
- DoS and DDoS attacks are out of scope

Out of scope issues
- Apparently outdated software alone (without associated risk): your submission should include an actual working PoC demonstrating a vulnerability. We have a detailed vulnerability/patch management approach, in which we might fix issues forking dependencies, triage exploitability etc…
- cookie flags, version disclosure, tab nabbing attacks, issues related to our DNS records

Scope special notes
The webshop host kaufland.de and other TLDs, such as kaufland.pl and kaufland.cz should not have any difference and we recommend testing only one of these.

Possible Awards:

Possible Awards for Bug Bounty Participants:
- Monetary Compensation: Receive a financial bounty via wire transfer for identifying and reporting impactful bugs.
- Good Karma: Your efforts contribute to enhancing digital security, benefiting the wider community.
- Recognition: Exceptional contributions will be acknowledged in our Hall of Fame, highlighting your expertise and dedication.

Other Submissions Handling