Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Alliander

Vulnerability disclosure program on Self-hosted alliander.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
1
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 5 days
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No If you qualify for a reward (The Alliander Security Hoodie), we will indicate this in our response.
Response
Within 5 days We will respond within 5 business days with our assessment of the report and an expected solution date.
Safe harbor
Full If you adhere to the above conditions, we will not take legal action regarding the report.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

1 asset you may test.

Web 1

  • Alliander web applications

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Alliander's policy.

While testing

  • Placing malware.
  • Copying, modifying, or deleting data in a system.
  • Making changes to the system.
  • Gaining repeated access to the system or sharing access with others.
  • Using brute force to gain access to a system.
  • Engaging in denial-of-service or social engineering.
  • Publicizing the issue. Please refrain from sharing the problem with others until it is resolved
  • Exploiting physical security attacks, social engineering, DDoS attacks, spam, or third-party applications.

Not accepted

  • Reports of outdated software versions.
  • Missing best practices or output from automated scanning tools without evidence of exploitability.
  • Using components of known vulnerability without relevant attack POC.
  • Automated scans of utilities. Example: Web, SSL/TLS scans, Nmap scan results, etc.
  • Self-XSS and XSS affecting only outdated browsers.
  • UI and UX bugs and typos.
  • Issues related to TLS/SSL.
  • SPF, DMARC, DKIM configurations.
  • Vulnerabilities in products at the end of their lifecycle.
  • Lack of a secure flag on cookies.
  • Enumeration of usernames.
  • Vulnerabilities dependent on the presence of plugins like Flash.
  • Defects affecting users of outdated browsers and plugins.
  • Missing security headers such as “content-type-options,” “X-XSS-Protection.”
  • Lack of CAPTCHAs as a security mechanism.
  • Problems related to maliciously installed applications on the device.
  • Vulnerabilities requiring a jailbroken device.
  • Vulnerabilities requiring physical access to a mobile device.
  • Use of a library known to have a security risk without evidence of usability.
  • Tap-jacking and UI redressing attacks misleading users to tap on a UI element.
  • Host header and banner grabbing problems.
  • Denial of Service attacks and Distributed Denial of Service attacks.
  • Speed-limiting, brute force attacks.
  • Login/logout/low-business impact CSRF.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.