Bug Bounty for Security Researchers

Participation

Security researchers worldwide aged 18 or over can participate. Persons and countries subject to sanctions are excluded. Researchers pay no fees.

In vulnerability disclosure programs (VDP), you can also report vulnerabilities anonymously and without a user account; no JavaScript is required.

Programs are offered by companies based in Germany and by public sector organizations such as public authorities, municipalities, universities and municipal IT service providers. The researcher area is bilingual, in German and English.

VDP and bug bounty programs

A vulnerability disclosure program (VDP) defines which systems you may test, which rules apply and how the organization offering the program handles your vulnerability report. No rewards are paid in a VDP.

In bug bounty programs, valid reports are rewarded; amounts and conditions are set in advance in the program rules. Programs are public or non-public; non-public programs are accessible by invitation only.

Creating and tracking reports

A report assistant guides you through your report, with a CVSS 4.0 calculator and CWE selection. In the editor, you can insert links and images; attachments are scanned for malware. For each report, you can see its status, who is responsible and the deadlines. You receive notifications in the application and by email; emails do not contain any vulnerability details.

Rules and safe harbor

Each program states its scope, its testing rules and its safe harbor status in a visible place. Rootsektor reviews new programs before publication. Before each test, check whether the system is in scope, and follow the rules of the respective program.

A safe harbor statement sets out which tests are permitted within a program and under which conditions the organization offering the program refrains from legal action. Whether and to what extent such a statement applies to a program is shown by its safe harbor status.

Such a statement cannot guarantee immunity from prosecution. Law enforcement authorities are not bound by it, and the provisions of the German Criminal Code, in particular Sections 202a et seq. StGB, apply regardless. Testing outside a program or contrary to its rules is not covered.

Response standard aligned with BSI TR-03183-3

A uniform response standard applies to the handling of reports. It is aligned with the Technical Guideline TR-03183-3 of the German Federal Office for Information Security (BSI):

• first personal response to your report within five business days
• qualified feedback within ten business days
• closure of VDP reports under the four-eyes principle

The four-eyes principle means that a report in a VDP is closed only after a second person has reviewed the decision. This also applies when a report is classified as a duplicate or as not applicable. If your report is classified as a duplicate, you receive proof of the earlier report.

Pseudonymity and Hall of Fame

You appear to companies under a pseudonym. In non-public programs, you appear under a separate alias for each program. You are listed in the Hall of Fame only on request.

Operation and security

bugbounty.de is operated by Rootsektor IT-Security GmbH in Arnsberg, Germany. Rootsektor verifies companies based on the commercial register and proof of domain ownership. Two-factor authentication, tenant isolation and encryption are standard.

NIS2, Cyber Resilience Act and security.txt

Germany’s NIS2 implementation in the BSI Act (BSIG) has been in force since December 6, 2025, and requires covered entities, among other things, to take measures for handling and disclosing vulnerabilities. The Cyber Resilience Act requires manufacturers of products with digital elements to have a process for coordinated vulnerability disclosure. Reporting obligations for actively exploited vulnerabilities have applied since September 11, 2026; the remaining requirements apply from December 11, 2027.

A VDP is one way to implement a defined reporting channel for vulnerabilities; whether and to what extent obligations apply must be assessed for each organization individually. A security.txt file in accordance with RFC 9116 at /.well-known/security.txt makes such a channel discoverable in machine-readable form.

Reporting vulnerabilities in bugbounty.de

If you find a vulnerability in bugbounty.de itself, please report it through the bugbounty.de vulnerability disclosure program. It describes the scope, the testing rules and the contact address security@bugbounty.de. No rewards are paid for reports in this VDP.