Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Infomaniak bug bounty programs

infomaniak.com Updated

Infomaniak runs one public program: a YesWeHack bug bounty paying up to €7,000.

Top reward
€7,000
YesWeHack
Programs
1
1 pays cash
Targets in scope
55
6 types
Last change
3 Nov 2026
1 week ago

Where to report

The one public program Infomaniak runs.

  • Infomaniak Bug Bounty program

    YesWeHack · Bug bounty

    Open

    Top reward

    €7,000
    Critical
    €7,000
    High
    €2,000
    Medium
    €600
    Low
    €100
    First response
    24 hours promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

55 targets. 17 excluded.

  • *.infomaniak.com

    Wildcards

  • *.kchat.infomaniak.com

    Wildcards

  • *.kdrive.infomaniak.com

    Wildcards

  • kdrive.infomaniak.com/app/*/preview/*

    Wildcards

  • kdrive.infomaniak.com/app/office*/*

    Wildcards

  • ksuite.infomaniak.com/*/kdrive/*/preview/*

    Wildcards

  • manager.infomaniak.com/*proxy*

    Wildcards

  • manager.infomaniak.com/v3/*

    Wildcards

  • storage*.infomaniak.com

    Wildcards

  • swiss-backup*.infomaniak.com

    Wildcards

  • *.vod2.infomaniak.com

    Wildcards

  • 5k8vrbdyje.infomaniak.site

    Web

  • calendar.infomaniak.com

    Web

  • chk.infomaniak.com

    Web

  • contacts.infomaniak.com

    Web

  • etickets.infomaniak.com

    Web

  • euria.infomaniak.com

    Web

  • fv3lfbdyjh.infomaniak.site

    Web

  • hosting-ik.com

    Web

  • infomaniak.events

    Web

  • ix2smbdyjt.infomaniak.site

    Web

  • kmeet.infomaniak.com

    Web

  • kpaste.infomaniak.com

    Web

  • ksuite.infomaniak.com

    Web

  • l75pvbdyjo.infomaniak.site

    Web

No target matches. Try part of a host name, such as the company name.

Out of scope 17

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • acronis.infomaniak.com

  • Assets not listed in the in scope section are to be considered as out of the scope of this program and won't be eligible for reward

  • Database service instances from customers, like *.dbaas.infomaniak.cloud

  • FTP credentials from our customers, like *.ftp.infomaniak.com

  • Information returned by /get-tickets-infos (including organizer, event_name, event_date, command_date, and masked email) is out of scope

  • Jelastic subdomains : *.jcloud.ik-server.com, *.jpc.infomaniak.com, *.jpe.infomaniak.com

  • Moving or copying calendar events / contacts between containers by read-write collaborators (intended behavior)

  • MySQL credentials from our customers, like *.myd.infomaniak.com

  • ov-XX.infomaniak.ch and od-XX.infomaniak.ch sub domains

  • Partner program: pages about finding partner and sending offer, and reports about data already public on the partner directory are not eligible. Missing authorization on partner-program routes exposing private data remains in scope.

  • S3 credentials from our customers, like s3.pub*.infomaniak.cloud

  • storage*.infomaniak.com/newsletter/thumbnails/*

  • This domain https://drive.infomaniak.com/app/office/:folder:/:file: is out of scope. This is only office application, an external app to open MS office documents.

  • User email verification

  • VPS instances from our customers, like *.vps.infomaniak.com

  • We do not manage Open Stack dashboard which is therefore out of scope

  • Websocket IPS-public credentials (MQTT, info-mq, IPS_RABBIT, ips-public). Public identifiers that do not allow access to information outside the scope of the user's profile.

Recent changes

Reward and scope changes across every Infomaniak program, newest first.

  • Scope −

    Removed from scope: manager.infomaniak.com/*proxy*

  • Scope +

    Added to scope: s3.gva1.infomaniak.cloud

  • Scope +

    Added to scope: s3.gva2.infomaniak.cloud

All changes · RSS feed

Recent CVEs

Published vulnerabilities in Infomaniak products, from the NVD.

Search NVD
  • CVE-2024-49274 Medium

    Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through <= 1.5.7.

About this page

This page gathers every public program listed under infomaniak.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.