Axel Springer National Media & Tech
By AS National Media & Tech (NMT) Bug bounty on Intigriti axelspringer.com
- Top reward
- €2,500
- Top severity paid
- Critical
- Assets in scope
- 41
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to €2,500
- for critical bugs, from €15.
- Report on Intigriti
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Intigriti lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
€2,500 from €250 |
| High |
|
€300 from €75 |
| Medium |
|
€150 from €50 |
| Low |
|
€50 from €15 |
Scope
41 assets you may test, 1 excluded.
Wildcard domains 25
- *.asadcdn.com
- *.as-nmt.de
- *.auth.bild.de
- *.autobild.de
- *.bild.de
- *.bild.design
- *.bild.tv
- *.bz-berlin.de
- *.computerbild.de
- dealer.prod.ps.axelspringer.de/purchases/*
- *.ein-herz-fuer-kinder.de
- *.fitbook.de
- *.germany.politico.eu
- *.hey.bild.de
- *.myhomebook.de
- *.petbook.de
- *.petbook-magazine.com
- *.sportbild.de
- *.spring-media.de
- *.springtools.de
- *.stylebook.de
- *.techbook.de
- *.travelbook.de
- *.welt.de
- *.wissen-sie-mehr.de
Web 15
- adtechnology.axelspringer.com
- bild.de
- cancellation.prod.ps.welt.de
- digital.welt.de
- editorial.one
- epaper.welt.de
- go.welt.de
- m.bild.de
- meinkonto.bild.de
- newsos.com
- politico.eu
- signin.auth.welt.de
- technik.autobild.de
- technik.beta.autobild.de
- welt.de
Networks 1
- 18.184.198.198, 18.185.214.59, 18.194.109.179, 3.121.117.72, 3.121.138.10, 3.121.138.128, 3.121.138.134, 3.121.138.170, 3.121.138.33, 3.121.138.43, 3.124.248.208, 35.156.137.39
Out of scope (1)
- *.axelspringer.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Axel Springer National Media & Tech (via Intigriti)'s policy.
While testing
-
Do not execute intrusive commands within production environments
-
Respect the scope of the program
-
Not discuss or disclose vulnerability information without prior written consent also not POCs.
-
Spam, social engineering, and phishing are not allowed. This includes any attack that requires luring a victim to an attacker-controlled domain.
-
Attacks that require physical access to a victim's computer/device, man-in-the-middle or compromised user accounts are not permitted.
-
Submissions without proof of concept will not be considered.
Not accepted
-
Credential disclosure without proven business impact
-
Pre-Auth Account takeover/OAuth squatting
-
CORS misconfiguration on non-sensitive endpoints
-
Cross-site Request Forgery with no or low impact
-
Reverse tabnabbing
-
Clickjacking without proven impact/unrealistic user interaction
-
CSV Injection
-
Sessions not being invalidated (logout, enabling 2FA, etc.)
-
Tokens leaked to third parties
-
Anything related to email spoofing, SPF, DMARC or DKIM
-
Content injection without being able to modify the HTML
-
Username/email enumeration
-
Please only email bomb yourself
-
Homograph attacks
-
XMLRPC enabled
-
Not stripping metadata of files
Summarised with AI from the program policy on Intigriti, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 7 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Status
Program status changed
-
Status
Program status changed
-
Scope removed
emarketer.com
-
Scope removed
*.emarketer.com
-
Scope removed
*.fitbook.de
-
Scope removed
*.springtools.de
-
Scope removed
*.computerbild.de
-
Scope removed
*.petbook-magazine.com/
-
Scope removed
*.bild.de
-
Scope removed
*.spring-media.de
-
Scope removed
*.bild.design
-
Scope removed
*.autobild.de
-
Scope removed
*.bz-berlin.de
-
Scope removed
*.sportbild.de
-
Scope removed
go.welt.de
-
Scope removed
cancellation.prod.ps.welt.de
-
Scope removed
digital.welt.de
-
Scope removed
technik.beta.autobild.de
-
Scope removed
technik.autobild.de
-
Scope removed
*.techbook.de
-
Scope removed
*.welt.de
-
Scope removed
*.auth.bild.de
-
Scope removed
signin.auth.welt.de
-
Scope removed
*.axelspringer.com (out of scope)
-
Scope removed
newsos.com
-
Scope removed
*.petbook.de
-
Scope removed
dealer.prod.ps.axelspringer.de/purchases/*
-
Scope removed
*.as-nmt.de
-
Scope removed
*.asadcdn.com
-
Scope removed
*.wissen-sie-mehr.de
-
Scope removed
editorial.one
-
Scope removed
welt.de
-
Scope removed
m.bild.de
-
Scope removed
politico.eu
-
Scope removed
epaper.welt.de
-
Scope removed
adtechnology.axelspringer.com
-
Scope removed
bild.de
-
Scope removed
18.184.198.198, 18.185.214.59, 18.194.109.179, 3.121.117.72, 3.121.138.10, 3.121.138.128, 3.121.138.134, 3.121.138.170, 3.121.138.33, 3.121....
-
Scope removed
*.ein-herz-fuer-kinder.de
-
Scope removed
*.germany.politico.eu
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from www.intigriti.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
AS National Media & Tech (NMT) is a subsidiary of Axel Springer SE, a leading international media company. We develop and operate digital products for Germany’s top news brands, reaching over 50 million users each month.
At Axel Springer, we stand for free journalism and unrestricted access to information, allowing people to make free decisions. To protect this, the security of our platforms and users is our top priority. Your contributions help us keep them safe.
Rules of engagement
By participating in this program, you agree to:
- Respect the Community Code of Conduct
- Do not execute intrusive commands within production environments
- Respect the scope of the program
- Not discuss or disclose vulnerability information without prior written consent also not POCs.
Validation times
We will always try to validate and accept your submissions as quickly as possible, for specific times you can check the average in the programme sidebar.
In scope
Our worst-case scenarios are:
- Publishing fake news on our website.
- Obtaining sensitive user data.
- Command execution on production services.
Out of scope
General
- If a reported vulnerability is already known to the company, it will be marked as duplicate.
- Vulnerabilities without realistic exploit scenario(s) or realistic attack surface(s) are assigned a severity of "None".
- Spam, social engineering, and phishing are not allowed. This includes any attack that requires luring a victim to an attacker-controlled domain.
- Submissions based on software that no longer receives security updates will not be considered.
- Attacks that require physical access to a victim's computer/device, man-in-the-middle or compromised user accounts are not permitted.
- New vulnerabilities with severity of critical or exceptional are out of scope for the first 7 days.
- New vulnerabilities with severity of high are out of scope for the first 14 days.
- New vulnerabilities with severity of medium or lower are out of scope for the first 30 days.
- Submissions without proof of concept will not be considered.
- Multiple submissions based on the same piece of code, misconfiguration or dependency will be treated as a single submission. The deciding factor will be whether the problem can be fixed in one go.
- We do not take responsibility for outgoing links.
- All domains not listed as in scope above.
- For the authenticated endpoint, we only accept cache poisoning submissions that are valid with changing authentication headers.
- IDOR attacks for the Hey chat, which include a UUID, are out of scope and the risk is accepted. However, we would greatly appreciate submissions to enumerate or guess these UUIDs.
Application
- Credential disclosure without proven business impact
- Pre-Auth Account takeover/OAuth squatting
- CORS misconfiguration on non-sensitive endpoints
- Cross-site Request Forgery with no or low impact
- Reverse tabnabbing
- Clickjacking without proven impact/unrealistic user interaction
- CSV Injection
- Sessions not being invalidated (logout, enabling 2FA, etc.)
- Tokens leaked to third parties
- Anything related to email spoofing, SPF, DMARC or DKIM
- Content injection without being able to modify the HTML
- Username/email enumeration
- Please only email bomb yourself
- Homograph attacks
- XMLRPC enabled
- Not stripping metadata of files
Severity
This program follows Intigriti's triage standards
FAQ
Do you have credentials to login into the applications?
No, we do not provide credentials for testing, but you are welcome to create your own account.
Can I give feedback to your program?
Yes certainly and we would appreciate use this feedback form for it.
Dos your program make use of retests?
Sometimes we will ask you to retest and offer up to a €50 bonus for doing so. If this offer is declined or expires and the submission is closed, we will not accept a submission with the same cause from the same researcher.