Public authorities, municipalities and other public sector organizations operate portals, specialized applications and interfaces through which citizens use administrative services. Anyone who discovers a vulnerability there needs a reliable way to report it. bugbounty.de is a bug bounty platform operated by Rootsektor IT-Security GmbH in Arnsberg, Germany, for vulnerability disclosure programs (VDP) and bug bounty programs with rewards. The offering takes the framework conditions of public administration into account.
Public bodies process data that citizens are often required to provide, for example for residence registration, social benefits or taxes. A vulnerability in these systems affects people who cannot choose their administration. A defined reporting channel helps to receive reports early and to limit damage.
With the digitalization of administrative services, for example under the Online Access Act (Onlinezugangsgesetz, OZG), more systems become reachable from the internet: application portals, user accounts, appointment booking and interfaces to specialized applications. Not every vulnerability in these systems is found by internal reviews or penetration tests.
Security researchers, citizens or service providers who report a vulnerability expect the report to be accepted, reviewed and answered. Without a defined process, reports can end up in general inboxes, remain unassigned or go unanswered. A vulnerability disclosure program defines responsibilities, deadlines and rules, and makes the handling of vulnerability reports traceable for everyone involved.
Depending on the type of organization, legal requirements may also apply. Germany’s implementation of the NIS2 Directive in the BSI Act (BSIG) has been in force since December 6, 2025, and requires covered entities, among other things, to take measures for handling and disclosing vulnerabilities. For state and municipal bodies, state law may also be relevant. Whether an organization is covered must be assessed in each individual case. A security.txt file in accordance with RFC 9116 makes the reporting channel discoverable on your own website.
For procurement and data protection review, you receive a service specification, a data processing agreement (DPA) under Art. 28 GDPR and a description of the technical and organizational measures (TOMs). The applicable procurement procedure depends on the law governing your organization and on the contract value, and is determined by your procurement office.
In bug bounty programs, public sector organizations pay rewards when they fall due instead of paying in advance into a reward budget. This takes into account that public budget law permits advance payments only to a limited extent, for example under Section 56 of the Federal Budget Code (Bundeshaushaltsordnung, BHO) and the corresponding provisions of the state budget codes; for municipalities, the respective municipal budget law applies.
Special terms apply to public authorities, municipalities and public-interest organizations. The basic VDP is free of charge; the terms for bug bounty programs and for additional services such as managed triage are available on request. The terms for public sector organizations are not tied to any consideration in return; this also applies to the special terms. This keeps the conditions of participation traceable for procurement offices and audit bodies.
The cooperation is based on a German contract and a DPA under Art. 28 GDPR. Two-factor authentication, tenant isolation and encryption are standard. Notifications are provided in the application and by email; emails do not contain any vulnerability details.
The user interface is in German. Your contact is Rootsektor IT-Security GmbH in Arnsberg. Managed triage in German by Rootsektor experts can be booked.
The response standard is aligned with the BSI Technical Guideline TR-03183-3: the reporter receives a first personal response within five business days and qualified feedback within ten business days. In a VDP, reports can be submitted without a user account, without JavaScript and, if preferred, anonymously. Each report has a status with assigned responsibility and deadlines; VDP reports are closed under the four-eyes principle.
The offering is aimed at public sector organizations in Germany, in particular:
Information for companies, for example on the Cyber Resilience Act, is available on the page Bug Bounty for Companies.
When you sign up, you are informed by email about the launch of bugbounty.de. Only an email address, the target group and your consent are required. You can also use a functional mailbox, for example that of your information security team. After submitting the form, you receive an email with a confirmation link (double opt-in); the sign-up becomes active only after confirmation. You can unsubscribe at any time.
Further information is available on the pages Bug Bounty for Companies and Bug Bounty for Security Researchers and in the FAQ. The page Report a Vulnerability shows how bugbounty.de itself receives reports.