Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Aegean Airlines Vulnerability Disclosure

By Aegean Airlines Vulnerability disclosure program on HackerOne aegeanair.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
292
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Scope

292 assets you may test, 1 excluded.

Web 292

  • a3cmgcmpoint2.aegeanair.com Critical No bounty
  • active.aegeanair.com Critical No bounty
  • admin.olympicair.com Critical No bounty
  • aegappsrv.aegeanair.com Critical No bounty
  • aegeanair.com Critical No bounty
  • agents.aegeanair.com Critical No bounty
  • agent.travelpackages.aegeanair.com Critical No bounty
  • airportmaps.aegeanair.com Critical No bounty
  • alphabankbonusconversionuat.aegeanair.com Critical No bounty
  • alphabankbonusconversionws.aegeanair.com Critical No bounty
  • alphabankbonusredemption.aegeanair.com Critical No bounty
  • alphabankbonusredemptionel.aegeanair.com Critical No bounty
  • alphabankbonusredemptioneluat.aegeanair.com Critical No bounty
  • alphabankbonusredemptionen.aegeanair.com Critical No bounty
  • alphabankbonusredemptionenuat.aegeanair.com Critical No bounty
  • alphabankbonusredemptionuat.aegeanair.com Critical No bounty
  • alphabankonlinebonusconversionel.aegeanair.com Critical No bounty
  • alphabankonlinebonusconversioneluat.aegeanair.com Critical No bounty
  • alphabankonlinebonusconversionen.aegeanair.com Critical No bounty
  • alphabankonlinebonusconversionenuat.aegeanair.com Critical No bounty
  • api.aegeanair.com Critical No bounty
  • api-des.aegeanair.com Critical No bounty
  • api-des.olympicair.com Critical No bounty
  • apiuat.aegeanair.com Critical No bounty
  • aqda3.aegeanair.com Critical No bounty
  • aqda3uat.aegeanair.com Critical No bounty
  • ar.aegeanair.com Critical No bounty
  • ar.staging.aegeanair.com Critical No bounty
  • assets.aegeanair.com Critical No bounty
  • assetsuat.aegeanair.com Critical No bounty
  • atcomws.aegeanair.com Critical No bounty
  • atcomwsuat.aegeanair.com Critical No bounty
  • atlassian-bounces.aegeanair.com Critical No bounty
  • author-staging.aegeanair.com Critical No bounty
  • autodiscover.aegeanair.com Critical No bounty
  • autodiscover.olympicair.com Critical No bounty
  • az-aa-smtp-1.aegeanair.com Critical No bounty
  • b2b.olympicair.com Critical No bounty
  • b2c.olympicair.com Critical No bounty
  • b2t.olympicair.com Critical No bounty
  • bagfinder.aegeanair.com Critical No bounty
  • baggageservices.aegeanair.com Critical No bounty
  • bagtrackingws.aegeanair.com Critical No bounty
  • bagtrackingwsuat.aegeanair.com Critical No bounty
  • beyond.aegeanair.com Critical No bounty
  • book.aegeanair.com Critical No bounty
  • book.layover.aegeanair.com Critical No bounty
  • book.transfers.aegeanair.com Critical No bounty
  • cabinreport.aegeanair.com Critical No bounty
  • cabinreportuat.aegeanair.com Critical No bounty
  • catering.aegeanair.com Critical No bounty
  • cateringuat.aegeanair.com Critical No bounty
  • ccc-hyperion.aegeanair.com Critical No bounty
  • certification.aegeanair.com Critical No bounty
  • certification.staging.aegeanair.com Critical No bounty
  • change.aegeanair.com Critical No bounty
  • change.olympicair.com Critical No bounty
  • checkin.staging.aegeanair.com Critical No bounty
  • cms.olympicair.com Critical No bounty
  • cns-admin.aegeanair.com Critical No bounty
  • cns-admin-qa.aegeanair.com Critical No bounty
  • confirm-my-flights.aegeanair.com Critical No bounty
  • confirm-my-flights-api.aegeanair.com Critical No bounty
  • confirm-my-flights.olympicair.com Critical No bounty
  • confirm-my-flights-qa.aegeanair.com Critical No bounty
  • confluence.aegeanair.com Critical No bounty
  • confluence.atl.aegeanair.com Critical No bounty
  • contenthub.aegeanair.com Critical No bounty
  • cyprusbankbonusredemptioneluat.aegeanair.com Critical No bounty
  • cyprusbankbonusredemptionenuat.aegeanair.com Critical No bounty
  • cyprusbankbonusredemptionuat.aegeanair.com Critical No bounty
  • cyprusbankredemption.aegeanair.com Critical No bounty
  • cyprusbankredemptionel.aegeanair.com Critical No bounty
  • cyprusbankredemptionen.aegeanair.com Critical No bounty
  • dbaas.aegeanair.com Critical No bounty
  • dbaas-test.aegeanair.com Critical No bounty
  • dcsmiddleware.aegeanair.com Critical No bounty
  • dcsmiddlewareqa.aegeanair.com Critical No bounty
  • dcsnotify.aegeanair.com Critical No bounty
  • de.about.aegeanair.com Critical No bounty
  • de.aegeanair.com Critical No bounty
  • de.author.aegeanair.com Critical No bounty
  • de.author-staging.about.aegeanair.com Critical No bounty
  • de.author-staging.aegeanair.com Critical No bounty
  • de.staging.about.aegeanair.com Critical No bounty
  • de.staging.aegeanair.com Critical No bounty
  • digital.aegeanair.com Critical No bounty
  • digital.olympicair.com Critical No bounty
  • eastpak.aegeanair.com Critical No bounty
  • ebooking.aegeanair.com Critical No bounty
  • el.about.aegeanair.com Critical No bounty
  • el.aegeanair.com Critical No bounty
  • el.agent.travelpackages.aegeanair.com Critical No bounty
  • el.author.about.aegeanair.com Critical No bounty
  • el.author.aegeanair.com Critical No bounty
  • el.author-staging.about.aegeanair.com Critical No bounty
  • el.author-staging.aegeanair.com Critical No bounty
  • el.staging.about.aegeanair.com Critical No bounty
  • el.staging.aegeanair.com Critical No bounty
  • email.classter.olympicair.com Critical No bounty
  • en.about.aegeanair.com Critical No bounty
  • en.aegeanair.com Critical No bounty
  • en.author.about.aegeanair.com Critical No bounty
  • en.author.aegeanair.com Critical No bounty
  • en.author-staging.about.aegeanair.com Critical No bounty
  • en.author-staging.aegeanair.com Critical No bounty
  • endysis.aegeanair.com Critical No bounty
  • en.staging.about.aegeanair.com Critical No bounty
  • en.staging.aegeanair.com Critical No bounty
  • epg.aegeanair.com Critical No bounty
  • eretailapi.staging.aegeanair.com Critical No bounty
  • eretail.staging.aegeanair.com Critical No bounty
  • es.about.aegeanair.com Critical No bounty
  • es.aegeanair.com Critical No bounty
  • es.author.aegeanair.com Critical No bounty
  • es.author-staging.about.aegeanair.com Critical No bounty
  • es.author-staging.aegeanair.com Critical No bounty
  • es.staging.about.aegeanair.com Critical No bounty
  • es.staging.aegeanair.com Critical No bounty
  • e-ticket.aegeanair.com Critical No bounty
  • eticket.aegeanair.com Critical No bounty
  • e-ticket.olympicair.com Critical No bounty
  • eurobankepistrofiel.aegeanair.com Critical No bounty
  • eurobankepistrofieluat.aegeanair.com Critical No bounty
  • eurobankepistrofien.aegeanair.com Critical No bounty
  • eurobankepistrofienuat.aegeanair.com Critical No bounty
  • eurobankepistrofiws.aegeanair.com Critical No bounty
  • eurobankepistrofiwsuat.aegeanair.com Critical No bounty
  • experiences.aegeanair.com Critical No bounty
  • extranet.aegeanair.com Critical No bounty
  • fbapps.aegeanair.com Critical No bounty
  • federation.aegeanair.com Critical No bounty
  • ferry.aegeanair.com Critical No bounty
  • flightlog.aegeanair.com Critical No bounty
  • flightloguat.aegeanair.com Critical No bounty
  • flights.aegeanair.com Critical No bounty
  • flydocsprd.aegeanair.com Critical No bounty
  • flydocsuat.aegeanair.com Critical No bounty
  • flyinbook.aegeanair.com Critical No bounty
  • fr.about.aegeanair.com Critical No bounty
  • fr.aegeanair.com Critical No bounty
  • fr.author.aegeanair.com Critical No bounty
  • fr.author-staging.about.aegeanair.com Critical No bounty
  • fr.author-staging.aegeanair.com Critical No bounty
  • fr.staging.about.aegeanair.com Critical No bounty
  • fr.staging.aegeanair.com Critical No bounty
  • fse.aegeanair.com Critical No bounty
  • ftp.aegeanair.com Critical No bounty
  • getthefeeling.aegeanair.com Critical No bounty
  • giortiaeroporias.aegeanair.com Critical No bounty
  • greecebygreeks.aegeanair.com Critical No bounty
  • groupoffice.aegeanair.com Critical No bounty
  • he.aegeanair.com Critical No bounty
  • he.staging.aegeanair.com Critical No bounty
  • hotel.aegeanair.com Critical No bounty
  • hotel.olympicair.com Critical No bounty
  • hotels.olympicair.com Critical No bounty
  • ibasket.aegeanair.com Critical No bounty
  • ibasket.staging.aegeanair.com Critical No bounty
  • images.aegeanair.com Critical No bounty
  • images.olympicair.com Critical No bounty
  • imode.aegeanair.com Critical No bounty
  • internaldatasharingwsuat.aegeanair.com Critical No bounty
  • iris.aegeanair.com Critical No bounty
  • it.about.aegeanair.com Critical No bounty
  • it.aegeanair.com Critical No bounty
  • it.author.aegeanair.com Critical No bounty
  • it.author-staging.about.aegeanair.com Critical No bounty
  • it.author-staging.aegeanair.com Critical No bounty
  • itselfservice.aegeanair.com Critical No bounty
  • it.staging.about.aegeanair.com Critical No bounty
  • it.staging.aegeanair.com Critical No bounty
  • jobs.aegeanair.com Critical No bounty
  • legdataws.aegeanair.com Critical No bounty
  • legdatawsuat.aegeanair.com Critical No bounty
  • lineup.aegeanair.com Critical No bounty
  • londonlaunch.aegeanair.com Critical No bounty
  • lyncdiscover.aegeanair.com Critical No bounty
  • m.aegeanair.com Critical No bounty
  • mailrelay.aegeanair.com Critical No bounty
  • mailserver.confirm.aegeanair.com Critical No bounty
  • mailserver.notification.aegeanair.com Critical No bounty
  • mailserver.notification.olympicair.com Critical No bounty
  • mblkvsiph.olympicair.com Critical No bounty
  • md5.staging.aegeanair.com Critical No bounty
  • mobapi.aegeanair.com Critical No bounty
  • mobapi.staging.aegeanair.com Critical No bounty
  • mobile.aegeanair.com Critical No bounty
  • mobile-int.aegeanair.com Critical No bounty
  • mobile.olympicair.com Critical No bounty
  • mobilepass.aegeanair.com Critical No bounty
  • mobile-staging.aegeanair.com Critical No bounty
  • myendysis.aegeanair.com Critical No bounty
  • mytravel.aegeanair.com Critical No bounty
  • mytraveluat.aegeanair.com Critical No bounty
  • new.staging.about.aegeanair.com Critical No bounty
  • notifications.aegeanair.com Critical No bounty
  • notifications-int.aegeanair.com Critical No bounty
  • notifications-staging.aegeanair.com Critical No bounty
  • o1.ptr609.aegeanair.com Critical No bounty
  • And 92 more on HackerOne.
Out of scope (1)
  • www.staging.aegeanair.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Aegean Airlines Vulnerability Disclosure (via HackerOne)'s policy.

While testing

  • All vulnerabilities must be reported exclusively via the HackerOne platform. Submissions through any other channels will not be considered.
  • Public disclosure of any vulnerability is strictly prohibited without prior written authorization from Aegean Airlines.
  • Testing must be limited to what is necessary to confirm the existence of a vulnerability. Avoid any activity that could cause disruption or harm.
  • Do not modify, delete, or access data.
  • Data exfiltration attempts are strictly forbidden under any circumstances.
  • Only interact with accounts that you own or have explicit permission to use.
  • Denial of Service (DoS) testing is not allowed.
  • Social engineering attacks (including phishing, vishing, and smishing) are strictly prohibited.
  • Physical intrusion attempts targeting Aegean facilities or infrastructure are not permitted.

Not accepted

  • Submissions categorized as Spam, Informational, or Not Applicable will not be eligible for disclosure.

Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Status

    Program status changed

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Overview

If you believe you have identified a valid security vulnerability in any Aegean Airlines product, service, or website, please submit your findings through HackerOne in accordance with the guidelines outlined below.

Program Rules

When conducting security research, you must adhere to the following principles:

  • All vulnerabilities must be reported exclusively via the HackerOne platform. Submissions through any other channels will not be considered.
  • Participation is not permitted for employees, contractors, or individuals currently engaged in a professional relationship with Aegean Airlines or its affiliates.
  • Public disclosure of any vulnerability is strictly prohibited without prior written authorization from Aegean Airlines.
  • Testing must be limited to what is necessary to confirm the existence of a vulnerability. Avoid any activity that could cause disruption or harm.
  • Do not modify, delete, or access data.
  • Data exfiltration attempts are strictly forbidden under any circumstances.
  • If sensitive or personal data is accessed unintentionally, immediately stop testing and report the issue through HackerOne.
  • Only interact with accounts that you own or have explicit permission to use.
  • Do not attempt to use a vulnerability to access additional systems or escalate privileges beyond scope.
  • Denial of Service (DoS) testing is not allowed.
  • Social engineering attacks (including phishing, vishing, and smishing) are strictly prohibited.
  • Physical intrusion attempts targeting Aegean facilities or infrastructure are not permitted.
  • Respect the privacy, safety, intellectual property, and business operations of Aegean Airlines and third parties.
  • Reports must include clear, reproducible steps and, when applicable, a proof-of-concept.
  • Submit one vulnerability per report unless chaining is required to demonstrate impact.
  • Multiple issues caused by the same root vulnerability will be treated as a single report.
  • In case of duplicate submissions, only the first valid report will be reviewed.
  • Avoid submitting large volumes of low-quality or incomplete reports.
  • If you are unsure about your testing approach, pause and contact the security team via HackerOne.

Testing

  • While you're welcome to create accounts where they are available, we ask that you use your HackerOne alias when doing so. You can find instructions on how to find your alias here: https://docs.hackerone.com/en/articles/8404308-hacker-email-alias
  • We're unable to provide account licenses or refund expenses incurred during testing.

Session Layer: HTTP Headers

Researchers should add headers to requests such as:

  • "X-HackerOne-Research: [H1 username]"

Responsible Disclosure

Aegean Airlines supports responsible disclosure and asks that researchers:

  • Submit all findings directly through HackerOne
  • Provide timely, accurate, and actionable information to allow efficient remediation
  • Act professionally and ethically at all times
  • Refrain from any public disclosure unless explicitly authorized in writing

Reports should include sufficient supporting material such as proof-of-concept code, screenshots, or logs. Submissions categorized as Spam, Informational, or Not Applicable will not be eligible for disclosure.

Disclosure Policy

  • Do not share or discuss any vulnerability details, including resolved issues, without explicit permission from Aegean Airlines.
  • Follow HackerOne's disclosure guidelines at all times.

Additional Rules

  • Ensure all reports are detailed and reproducible.
  • Submit one vulnerability per report unless chaining is required.
  • Duplicate reports: only the first valid submission will be triaged.
  • Multiple findings caused by a single root issue will be treated as one.
  • Social engineering is strictly prohibited.
  • Make every effort to avoid privacy violations, data loss, or service disruption.
  • Interact only with accounts that you own or are authorized to use.

Thank you for helping keep Aegean Airlines and our users safe!