Frequently Asked Questions About Bug Bounty and bugbounty.de

bugbounty.de is a platform for vulnerability disclosure programs (VDP) and bug bounty programs with rewards. The platform connects companies and public sector organizations in Germany with security researchers from around the world; vulnerabilities are reported and handled according to clear rules. The operator is Rootsektor IT-Security GmbH, based in Arnsberg, Germany. Information for each target group is available on the pages Bug Bounty for Companies, Bug Bounty for Public Authorities and Municipalities and Bug Bounty for Security Researchers. Provider details are given in the legal notice.

The launch date will be announced on this website and by email to contacts who have signed up. The sign-up is available on the home page.

A vulnerability disclosure program (VDP) defines how vulnerabilities can be reported to an organization, which systems are covered, and how reports are handled and disclosed in a coordinated manner. No rewards are paid in a VDP. A bug bounty program is based on the same principles, but rewards are also paid for reports that meet the program conditions. A VDP thus creates a structured reporting channel, while a bug bounty program additionally provides incentives for targeted testing. bugbounty.de covers both program types: vulnerability disclosure programs, public or by invitation, and bug bounty programs with rewards.

bugbounty.de has set up a vulnerability disclosure program for its own systems. The reporting channel and rules are described on the page Report a Vulnerability. The contact details are also available in machine-readable form in the security.txt file in accordance with RFC 9116. Information about potential vulnerabilities should be submitted exclusively through this channel and not via social networks or other public channels, so that coordinated handling remains possible.

Programs can be set up by companies based in Germany, by public administration bodies such as public authorities and municipalities, and by universities and municipal IT service providers. Companies are verified via the commercial register and proof of domain ownership. Setup is guided: scope, rules and safe harbor status are defined for each program, and Rootsektor reviews every new program before it is published. A German contract and a data processing agreement form the basis; the user interface is in German. Details are available on the pages Bug Bounty for Companies and Bug Bounty for Public Authorities and Municipalities. You can sign up for the launch.

The basic VDP is free of charge. The terms for bug bounty programs and for additional services such as managed triage are available on request; special terms apply to public authorities, municipalities and public-interest organizations. Researchers pay no fees.

Germany’s NIS2 implementation in the BSI Act (BSIG) has been in force since December 6, 2025, and requires covered entities, among other things, to take measures for handling and disclosing vulnerabilities. The Cyber Resilience Act requires manufacturers of products with digital elements to have a process for coordinated vulnerability disclosure. Reporting obligations for actively exploited vulnerabilities have applied since September 11, 2026; the remaining requirements apply from December 11, 2027. A VDP with a security.txt file in accordance with RFC 9116 provides a discoverable reporting channel. Whether and to what extent obligations apply must be assessed in each individual case; the platform does not replace legal advice.

Reports are subject to a response standard aligned with the BSI Technical Guideline TR-03183-3: a first personal response within five business days and qualified feedback within ten business days. Each report has a traceable status with responsibility and deadlines. Reports in VDPs are closed under the four-eyes principle. If a report is classified as a duplicate, the reporting person receives proof of the earlier report. Reports can be exported as PDF. Organizations that do not want to screen incoming reports themselves can book managed triage in German by Rootsektor experts.

Vulnerability information is sensitive, especially as long as the vulnerabilities have not been fixed. Two-factor authentication, tenant isolation and encryption are therefore standard. Organization accounts have two roles: admin and member. Notifications appear in the application and are sent by email; emails do not contain any vulnerability details. Attachments are scanned for malware. Researchers appear to companies under a pseudonym, and in non-public programs under a separate alias for each program.

A German contract and a data processing agreement under Art. 28 GDPR form the basis of the collaboration; the user interface is in German. The basic VDP is free of charge, and special terms apply to public authorities, municipalities and public-interest organizations. The classification under public procurement law is the responsibility of the respective organization. More on the page Bug Bounty for Public Authorities and Municipalities.

Researchers worldwide aged 18 and over can participate. Sanctioned persons and countries are excluded. Researchers appear to companies under a pseudonym, and in non-public programs under a separate alias for each program. Listing in the Hall of Fame is only on request. Researchers pay no fees, and the researcher area is bilingual (German and English). Further information is available on the page Bug Bounty for Security Researchers.

A report assistant with a CVSS 4.0 calculator and CWE selection guides the creation of a report. The editor supports links and images; attachments are scanned for malware. Reports to a VDP can also be submitted anonymously, without a user account and without JavaScript.

No rewards are paid in a vulnerability disclosure program. In bug bounty programs, rewards are paid for reports that meet the program conditions; the amounts and requirements are set by each program in its rules. Researchers pay no fees. Regardless of rewards, a listing in the Hall of Fame is possible on request.

Each program states its safe harbor status. In a safe harbor statement, an organization usually undertakes not to take legal action against researchers who comply with the program rules. Neither such a statement nor the platform can guarantee immunity from prosecution: law enforcement authorities are not bound by such statements, and the provisions of the German Criminal Code, in particular Sections 202a et seq. StGB, apply regardless. Testing outside a program or contrary to its rules is not covered.

Only the email address, the selected target group (researcher, company or public sector organization) and consent are required for the sign-up. After submission, an email with a confirmation link is sent (double opt-in). The sign-up becomes active only once it has been confirmed via this link; without confirmation, no further emails are sent. Everyone who has signed up receives information about the launch of bugbounty.de by email; the information sent is determined by the consent, whose wording the form shows once a target group has been selected. The sign-up is available on the home page.

Consent can be withdrawn at any time with effect for the future. The emails contain a personal unsubscribe link for this purpose. After unsubscribing, no further information about the launch is sent. Consent can also be withdrawn using the contact details given in the legal notice. The privacy policy describes what happens to the stored data after unsubscribing. Signing up again is possible at any time and requires a new double opt-in confirmation.

The email address, the selected target group and the information required to prove consent are processed. The data is stored in encrypted form. The legal basis for sending the information is consent under Art. 6(1)(a) GDPR. The controller is Rootsektor IT-Security GmbH in Arnsberg, Germany. The data is used only for the purpose stated in the consent. Microsoft 365 is used to send the emails. Details on recipients, retention periods and the rights of data subjects are provided in the privacy policy.

The website uses Google Analytics 4 for web analytics, but only after explicit consent via the consent banner. The “Reject all” and “Accept all” buttons are presented with equal prominence. Without consent, Google Analytics is not loaded: no connection to Google is established and no cookies are set. The choice made in the consent banner and the selected display mode (light or dark) are stored locally in the browser. Consent can be withdrawn at any time via the “Cookie settings” link in the footer. The provider is Google Ireland Limited; data may be transferred to Google LLC in the USA on the basis of the EU-US Data Privacy Framework. Consent is obtained in accordance with Section 25(1) of the German TDDDG and Art. 6(1)(a) GDPR. Details are provided in the privacy policy.