Coordinated and Responsible Vulnerability Disclosure Free Bug Bounty Program 419,924 coordinated disclosures
228,381 fixed vulnerabilities
567 bug bounties with 1107 websites
11,361 researchers, 932 honor badges GmbH Bug Bounty Program GmbH runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of GmbH

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between GmbH and researchers.

Bug bounty program allow all submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

You can exploit the vulnerability for demonstration purpose, but this should not lead to service outages as well as the manipulation or loss of data. The purpose of the demonstration should show the full attack vector and should not cause any damage.

Do not share gathered information with third parties.

Please make sure to provide enough information so that we can reproduce the issue. A short description including a problem description and the URL of the affected system should be sufficient.

Testing Requirements:


- Physical security
- Social engineering
- Distributed Denial of Service (DDoS) attacks
- Spam & Phishing
- Exploiting vulnerabilities on systems which are dedicated to our customers

Possible Awards:

At the moment there are no general rewards, but this might change in the near future. Of course, rewards are not completely excluded.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

    12 August, 2019
Responsive and friendly :)

  Latest Patched


  Latest Blog Posts

19.08.2019 by ismailtsdln
IBM - Cross site Scripting [XSS]
15.08.2019 by thevivekkryadav
13.08.2019 by Renzi25031469
XSSCon - XSS Tool @Kitploit
13.08.2019 by Cur1S3
I Found a multiple xss on
13.08.2019 by ZIKADS
xss at

  Recent Recommendations

    21 August, 2019
Thank you, Rooghz, for pointing out a vulnerability on one of our websites.
    20 August, 2019
Thank you for the reported vulnerability! I thought I had those XSS pitfalls covered, but aparently not.
    20 August, 2019
Thanks for reporting the issue and the vulnerability details!!!
    19 August, 2019
Thanks for reporting the problem and the vulnerability details.
    18 August, 2019
thanks sir