- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 7
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs, from $250.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 from $4,000 |
| High |
|
$2,400 from $2,000 |
| Medium |
|
$900 from $600 |
| Low |
|
$300 from $250 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $5,000
Scope
7 assets you may test, 16 excluded.
Web 6
- https://audio.20min.ch
- https://coral.20min.ch
- https://partner-feeds.20min.ch
- https://screenplayer.20min.ch
- https://videoplayer.20min.ch
- https://www.20min.ch
APIs 1
- https://api.20min.ch
Out of scope (16)
- https://cre-api.tamedia.ch
- https://tgt.tamedia.ch
- DMARC, SPF, DKIM
- Other Domains and Subdomains not specifically in scope
- Subdomain Takeover
- http://auth.20min.ch
- https://*.connect.ringier.ch
- https://track.20min.ch
- Social Media Links (older than 2 years)
- *.20min-tv.ch
- *.appuser.ch
- *.iagentur.ch
- *.newsnetz.tv
- *.onelog.ch
- *.streamboat.ch
- *.streamboatserver.ch
Rules
What the policy asks of you, and the bug types it won't reward, quoted from 20 Minuten (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
Testing is only authorized on the targets listed as In-Scope.
-
Where a simple (free) registration is offered, please use your @bugcrowdninja.com email address.
-
Please note that the login itself is out of scope.
-
If you believe you've identified a vulnerability on a system outside the scope, please reach out to [email protected] before submitting.
Not accepted
-
No rate-limiting or (D)DoS attack related submissions
-
No aggressive automated scans as these will most likely lock you out (by AWS)
-
No automated scan reports without valid proof of concept
-
Subdomain takeovers
-
DMARC, DKIM and SPF
-
We won't accept broken or nonexistent social media links like Twitter, Facebook, Instagram.
-
Manipulation of polls, likes on comments and content ratings, and comment abuse reports / escalations. They are considered as accepted risk.
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 40 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
Social Media Links (older than 2 years) (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Launched in 1999, 20 Minuten is the number one daily commuter newspaper for Switzerland. It provokes discussion with its news on politics, business, sport, entertainment and services. Security is a top priority for us and that is why we are running a public Bug Bounty program for our 20 Minuten website ( https://www.20min.ch ). We want to ensure our newspaper can stand up to the best hackers in the world from day 0! This website is always in development and subject to continuous updates and new features. Other 20 Minuten websites, including legacy sites, are not part of this program, so please focus your efforts on www.20min.ch. Checkout the Target Groups for more information and good luck! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Testing is only authorized on the targets listed as In-Scope. Any domain/property of 20 Minuten not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to [email protected] before submitting. Access / Credentials The target URLs are publicly available For some testing a login might be required for the main site. Where a simple (free) registration is offered, please use your @bugcrowdninja.com email address. Please note that the login itself is out of scope. Environment The target environment is production, running on AWS (Kubernetes, Node/JS, Go) Out of Scope No rate-limiting or (D)DoS attack related submissions No aggressive automated scans as these will most likely lock you out (by AWS) No automated scan reports without valid proof of concept Login and session management related to our Open ID provider, including user registration, login, logout and password reset https://tgt.tamedia.ch https://auth.20min.ch https://cre-api.tamedia.ch https://track.tagesanzeiger.ch https://*.connect.ringier.ch Subdomains not specifically listed in scope iOS and Android apps Subdomain takeovers DMARC, DKIM and SPF We won't accept broken or nonexistent social media links like Twitter, Facebook, Instagram. Manipulation of polls, likes on comments and content ratings, and comment abuse reports / escalations. They are considered as accepted risk. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.