- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 81
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- https://arxiv.org/html/2509.06136v1
- Replies within 90 days
- As the policy promises.
Rewards
What the company's own policy page says it pays.
When we last read the linked page (12 Nov 2026), it did not look like a security policy. The program may have moved or closed; check the company's site before you test.
This program does not pay cash rewards.
- Pays cash
-
No
Just 33 bug bounty programs offer publicly accessible AI reward information after excluding private programs, platforms that do not accept AI vulnerabilities, and those that do not offer monetary rewards.
- Response
-
Within 90 days
Response windows also varied widely, from fixed timelines like “ within 90 days ” to vague phrasing such as “ we will get back to you as soon as possible. ” The majority of AI-specific policies (65%) provide a concrete…
- Legal protection
-
Stated
VDPs offer recognition and a safe harbor from legal prosecution for researchers who report vulnerabilities [ 18 , 38 ] .
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
81 assets you may test.
Domains 79
- adidas.de No bounty
- airbus.com No bounty
- allianz.de No bounty
- basf.com No bounty
- bayer.com No bounty
- beiersdorf.de No bounty
- bmw.de No bounty
- brenntag.com No bounty
- commerzbank.de No bounty
- continental.com No bounty
- covestro.com No bounty
- daimlertruck.com No bounty
- deutsche-bank.de No bounty
- deutsche-boerse.com No bounty
- deutschepost.de No bounty
- eon.de No bounty
- fresenius.com No bounty
- hannover-re.com No bounty
- heidelbergmaterials.de No bounty
- henkel.de No bounty
- infineon.com No bounty
- mercedes-benz.com No bounty
- merckgroup.com No bounty
- mtu.de No bounty
- munichre.com No bounty
- porsche.com No bounty
- porsche-se.com No bounty
- qiagen.com No bounty
- rheinmetall.com No bounty
- rwe.com No bounty
- sap.com No bounty
- sartorius.com No bounty
- siemens.com No bounty
- siemens-energy.com No bounty
- siemens-healthineers.com No bounty
- symrise.com No bounty
- telekom.de No bounty
- volkswagenag.de No bounty
- vonovia.de No bounty
- www.adidas.de
- www.airbus.com
- www.allianz.de
- www.basf.com
- www.bayer.com
- www.beiersdorf.de
- www.bmw.de
- www.brenntag.com
- www.commerzbank.de
- www.continental.com
- www.covestro.com
- www.daimlertruck.com
- www.deutsche-bank.de
- www.deutsche-boerse.com
- www.deutschepost.de
- www.eon.de
- www.fresenius.com
- www.hannover-re.com
- www.heidelbergmaterials.de
- www.henkel.de
- www.infineon.com
- www.mercedes-benz.com
- www.merckgroup.com
- www.mtu.de
- www.munichre.com
- www.porsche.com
- www.porsche-se.com
- www.qiagen.com
- www.rheinmetall.com
- www.rwe.com
- www.sap.com
- www.sartorius.com
- www.siemens.com
- www.siemens-energy.com
- www.siemens-healthineers.com
- www.symrise.com
- www.telekom.de
- www.volkswagenag.de
- www.vonovia.de
- www.zalando.com No bounty
Products and areas 2
- AI System No bounty
- System Integrity No bounty
Changes
Tracked since 12 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.