Report a Vulnerability: VDP of the Bug Bounty Platform bugbounty.de

Contact

Please send reports by email to security@bugbounty.de.

• Reports can be submitted in German or English.
• Neither a user account nor a name is required. Reports can also be submitted anonymously.
• The contact details are also available in machine-readable form in the security.txt file in accordance with RFC 9116.
• The security.txt file is signed with OpenPGP. Public key: pgp-key.txt, fingerprint 1E12 A846 BEC5 5C47 D0E3 0D98 8068 8A58 FEA0 8DFB.

Scope

In scope:

• bugbounty.de and www.bugbounty.de
• all subdomains of bugbounty.de
• the applications operated there, in particular the sign-up form with its confirmation and unsubscribe links
• the DNS configuration of the domain, for example with regard to a possible subdomain takeover

Out of scope:

• systems and services of third parties used by bugbounty.de, such as the infrastructure of the hosting provider STRATO, Microsoft 365 for sending emails and Google Analytics for web analytics. Please report vulnerabilities in these services themselves directly to the respective provider.
• other domains, including other domains of Rootsektor IT-Security GmbH
• systems of organizations that offer programs on bugbounty.de. The rules of the respective program apply to them.
• denial-of-service attacks as well as load and stress tests
• social engineering targeting employees of Rootsektor IT-Security GmbH or its service providers, such as phishing or phone calls
• physical attacks on buildings, data centers or devices
• reports without a demonstrable security impact, for example missing HTTP security headers without an attack scenario or unverified output of automated scanners

Testing rules

• Test only in good faith and only systems that are in scope.
• Use the sign-up form only with your own email addresses. Each submission triggers an email to the address entered; third-party addresses must not be entered.
• Use automated tools only with low load, at no more than 5 requests per second.
• Do not access, modify or delete third-party data. If you gain access to personal or confidential data, stop testing immediately, include only the information required as evidence in the report and delete the data afterwards.
• Exploit a vulnerability only as far as necessary to demonstrate it. Do not install backdoors, do not make persistent changes and do not extend access to other systems.
• Keep information about the vulnerability confidential until disclosure has been coordinated.
• Do not link reports to demands, for example for payment.
• If anything is unclear, for example whether a test is within these rules, contact security@bugbounty.de before testing further.

Content of a report

A report should include the following information:

• affected URL or system
• description of the vulnerability
• steps to reproduce, with a proof of concept if needed
• possible impact
• time period of the tests and, if possible, the IP addresses used
• a way to contact you for follow-up questions, if desired

Please do not submit credentials or personal data of third parties. A note on where they are accessible is sufficient.

Response standard

Reports to security@bugbounty.de are handled according to a response standard aligned with the BSI Technical Guideline TR-03183-3:

• first personal response within five business days
• qualified feedback with an assessment of the report within ten business days
• closure of a report only after review by a second person (four-eyes principle)
• coordinated disclosure with a default period of 90 days

Publication is coordinated with the person who submitted the report and must not contain personal data of third parties or credentials.

No rewards

This VDP is not a bug bounty program. No rewards or other compensation are paid for reports.

Data protection

Information contained in reports is processed in order to handle the report. Details are provided in the privacy policy; information about the operator is provided in the legal notice.

Further information

Information about the platform is available on the pages Bug Bounty for Security Researchers, Bug Bounty for Companies and Bug Bounty for Public Authorities and Municipalities and in the FAQ. If you would like to be informed about the launch of bugbounty.de, you can sign up.