Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Utrecht University bug bounty programs

uu.nl Updated

Utrecht University runs one public program: a security.txt disclosure program with no cash rewards.

Top reward
No cash
Disclosure only
Programs
1
None pays cash
Targets in scope
3
1 type
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Utrecht University runs.

  • Utrecht University

    security.txt · Disclosure only

    Open

    Top reward

    No cash
    Safe harbor
    Full
    First response
    5 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

3 targets. 19 excluded.

  • student website (it)

    Domains No bounty

  • students.uu.nl/it

    Domains No bounty

  • uu.nl

    Domains

No target matches. Try part of a host name, such as the company name.

Out of scope 19

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Anything related to HTTP/XML security headers

  • Authentication for public FTP mirrors for open-source projects

  • Best practices recommendations or hardening measures without a demonstrable impact on the confidentiality, integrity or availability of our systems or data

  • Clickjacking and issues only exploitable through clickjacking

  • Disclosure of known public files or directories or non-sensitive information (e.g. robots.txt)

  • Disclosure of publicly available software and/or source code

  • Expired or otherwise misconfigured SSL/TLS certificates, unless it can be demonstrated that they result in a security risk

  • Fingerprint version banner disclosure on common/public services

  • Host header injection

  • HTTP 404 codes/pages or other HTTP non-200 codes/pages and content spoofing/text injection on these pages

  • Information leaks in metadata

  • Issues with mixed-content warnings

  • Issues with the HTTP 'referer' header

  • Lack of secure/HTTP-only flags on non-sensitive cookies

  • Missing limits on login attempts

  • OPTIONS HTTP method enabled

  • Reporting older versions of any software without proof of concept or working exploit

  • SPF, DKIM, DMARC issues

  • SSL Configuration Issues

Recent changes

Reward and scope changes across every Utrecht University program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

About this page

This page gathers every public program listed under uu.nl: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.