bugbounty.de connects companies in Germany with security researchers from around the world: reliable vulnerability reporting, clear rules and fair collaboration.
bugbounty.de addresses three target groups with different requirements; each target group has its own page with further information. The platform is operated by Rootsektor IT-Security GmbH, based in Arnsberg, Germany.
bugbounty.de offers companies based in Germany a structured reporting channel for vulnerabilities: as a vulnerability disclosure program (VDP) or as a bug bounty program with rewards. A German contract and a data processing agreement form the basis; the user interface is in German.
More on the page Bug Bounty for Companies.
bugbounty.de offers public authorities, municipalities, universities and municipal IT service providers the same program types as companies. Special terms apply to public authorities, municipalities and public-interest organizations. A German contract and a data processing agreement under Art. 28 GDPR form the basis.
More on the page Bug Bounty for Public Authorities and Municipalities.
Security researchers worldwide aged 18 and over can participate; sanctioned persons and countries are excluded. Researchers appear to companies under a pseudonym, and in non-public programs under a separate alias for each program. Listing in the Hall of Fame is only on request. Researchers pay no fees.
More on the page Bug Bounty for Security Researchers.
Three principles guide the design of the platform.
Programs have clear rules defined in advance so that decisions on reports are traceable. Organizations receive reports through a structured channel, and researchers know in advance which systems they may test and under which conditions. A uniform response standard sets deadlines for responses.
Vulnerability information is sensitive, especially as long as the vulnerabilities have not been fixed. Two-factor authentication, tenant isolation and encryption are therefore standard. Notifications appear in the application and are sent by email; emails do not contain any vulnerability details.
The response standard is described on this website, and each program states its scope, rules and safe harbor status. Each report has a traceable status with responsibility and deadlines; duplicates are documented with proof.
Researchers, companies and public sector organizations can sign up to be informed by email about the launch of bugbounty.de. The information sent is determined by the consent; its wording is shown in the form once a target group has been selected.
Only the email address, the selected target group and consent are required. After submission, an email with a confirmation link is sent (double opt-in); the sign-up becomes active only after confirmation. You can unsubscribe at any time. Details are provided in the privacy policy.
Further questions and answers are available on the FAQ page.
The launch date will be announced on this website and by email to contacts who have signed up.
A VDP provides a defined reporting channel for vulnerabilities, without rewards. In a bug bounty program, rewards are also paid for reports. bugbounty.de covers both program types.
The basic VDP is free of charge. The terms for bug bounty programs and for additional services such as managed triage are available on request; special terms apply to public authorities, municipalities and public-interest organizations. Researchers pay no fees.
Germany’s NIS2 implementation in the BSI Act (BSIG) has been in force since December 6, 2025, and requires covered entities, among other things, to take measures for handling and disclosing vulnerabilities. The Cyber Resilience Act requires manufacturers of products with digital elements to have a process for coordinated vulnerability disclosure; reporting obligations for actively exploited vulnerabilities have applied since September 11, 2026, and the remaining requirements apply from December 11, 2027. A security.txt file in accordance with RFC 9116 makes an organization’s reporting channel discoverable; a VDP can provide this channel. Whether and to what extent obligations apply to an organization must be assessed in each individual case. The page Report a Vulnerability describes how bugbounty.de itself receives vulnerability reports.