Bug Bounty for Companies

Benefits of a VDP and a bug bounty program

A vulnerability disclosure program (VDP) defines how external parties report vulnerabilities to your company, which systems are in scope and how reports are handled. A bug bounty program adds rewards for valid reports to this framework; amounts and conditions are set in advance in the program rules.

For your company, such a program provides:

• Early awareness: You create a confidential channel through which you can learn about vulnerabilities before they become known elsewhere.
• Clear responsibilities: Vulnerability reports do not go to general inboxes but are handled in a defined process with deadlines and named owners.
• Guidance for reporters: Rules on scope and permitted methods show security researchers what they may test and how to report findings.
• Traceability: A documented process from receipt to remediation can serve as evidence for customers, auditors or supervisory authorities.

A VDP complements your own testing, such as penetration tests, but does not replace it. The program run by bugbounty.de itself, described on the page Report a Vulnerability, shows what a reporting channel can look like.

Regulatory context: NIS2 and the Cyber Resilience Act

Germany’s implementation of the NIS2 Directive in the BSI Act (BSIG) has been in force since December 6, 2025. Among other things, it requires covered entities to take measures for handling and disclosing vulnerabilities.

The Cyber Resilience Act (CRA) requires manufacturers of products with digital elements to have a process for coordinated vulnerability disclosure. Reporting obligations for actively exploited vulnerabilities have applied since September 11, 2026; the remaining requirements apply from December 11, 2027.

A VDP with fixed deadlines and a documented process can be one building block for meeting these requirements. A security.txt file in accordance with RFC 9116 makes your reporting channel discoverable on your website. Whether and which obligations apply to your company depends on factors such as sector, size and products, and must be assessed in each individual case. Using bugbounty.de does not replace this assessment.

Scope of services

For companies, bugbounty.de includes the following services:

• VDP and bug bounty programs: vulnerability disclosure programs, public or by invitation, and bug bounty programs with rewards for valid reports.
• Guided program setup: Scope, rules and safe harbor status are defined for each program and shown in the program. Rootsektor reviews every new program before publication.
• Response standard aligned with BSI TR-03183-3: first personal response to the reporter within five business days, qualified feedback within ten business days.
• Report assistant and editor: Researchers create reports with a report assistant that includes a CVSS 4.0 calculator and CWE selection. The editor supports links and images; reports can be exported as PDF. Attachments are scanned for malware.
• Traceable handling: Each report has a status with assigned responsibility and deadlines. VDP reports are closed only after a second person has confirmed the closure (four-eyes principle). If a report is classified as a duplicate, the reporter receives proof of the earlier report.
• Reporting without a user account: In a VDP, reports can be submitted without registration, without JavaScript and, if preferred, anonymously.
• Pseudonymity: Researchers appear to you under a pseudonym, and under a separate alias for each program in non-public programs. On request, they are listed in the Hall of Fame.
• Eligible researchers: worldwide, aged 18 or over, except sanctioned persons and countries.
• Managed triage in German: Rootsektor experts review and classify incoming reports. The service can be booked.

Pricing

The basic VDP is free of charge. The terms for bug bounty programs and for additional services such as managed triage are available on request.

Process on the platform

1. Verify your company: Rootsektor verifies your company based on the commercial register and proof of domain ownership.
2. Set up a program: In the guided program setup, you define scope, rules and responsibilities. The response standard and safe harbor status are shown in the program.
3. Review and publish: Rootsektor reviews the program before publication. You then link to the program on your website and in your security.txt file.
4. Handle reports: Incoming reports are reviewed, by managed triage if booked, and answered within the deadlines. Status, responsibility and deadlines are traceable at all times.
5. Close reports: VDP reports are closed under the four-eyes principle. For your records, reports can be exported as PDF.

Trust and data protection

Vulnerability information is sensitive. The platform is therefore based on the following principles:

• The operator is Rootsektor IT-Security GmbH, based in Arnsberg, Germany.
• The cooperation is based on a German contract and a data processing agreement (DPA); the user interface is in German.
• Two-factor authentication, tenant isolation and encryption are standard. Accounts of your company have the role Admin or Member.
• Notifications are provided in the application and by email. Emails do not contain any vulnerability details.

The privacy policy describes which data is processed when you visit this website and when you sign up.