- Top reward
- €500
- Top severity paid
- Critical
- Assets in scope
- 18
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to €500
- for critical bugs, from €50.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
€500 |
| High |
|
€200 |
| Medium |
|
€100 |
| Low |
|
€50 |
- Top reward
-
€500
Critical │ Remote code execution, authentication bypass, major data exposure │ From €500
- Lowest reward
-
€50
Low │ Minor misconfigurations with limited impact │ €50
- Response
-
Within 2 days
acknowledge receipt of your report within 2 business days;
- Safe harbor
-
Full
not initiate legal action against you for activities conducted in accordance with this policy.
- Hall of fame
-
Yes
Billie may, at its discretion, offer monetary rewards, public recognition, or other acknowledgements for valid and impactful security reports.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
18 assets you may test, 5 excluded.
Domains 16
- billie.io
- bnpl.demo.billie.io
- debug.tagging.billie.io
- demoshop.billie.io
- designated-survivor.billie.io
- fp.billie.io
- media.billie.io
- paella.billie.io
- paella-sandbox.billie.io
- partners.billie.io
- partners-sandbox.billie.io
- portal.billie.io
- salesforce-api.billie.io
- salesforce-api-tmp.billie.io
- tagging.billie.io
- transaction-monitoring.billie.io
Wildcard domains 2
- *.bnpl.demo.billie.io
- *.transaction-monitoring.billie.io
Out of scope (5)
- development, staging, testing, and sandbox systems
- internal systems and employee-only environments
- physical infrastructure and office environments
- systems requiring unauthorised access methods
- third-party platforms and providers not operated by Billie
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Billie's policy.
While testing
-
act responsibly and avoid causing harm
-
only access data belonging to your own test accounts
-
avoid privacy violations, data destruction, or modification of information
-
avoid disrupting services or affecting other users
-
stop testing immediately if you encounter sensitive data
-
report findings promptly
-
avoid public disclosure until the issue has been resolved or disclosure has been coordinated with Billie
-
If sensitive data is accessed unintentionally during testing, it must not be stored, shared, or further processed and should be securely deleted once the issue has been reported.
Not accepted
-
denial of service (DoS/DDoS) testing
-
social engineering or phishing attacks
-
physical attacks against Billie employees or infrastructure
-
automated scanning that negatively impacts service availability
-
attempts to access, modify, or delete data belonging to other users
-
spam, resource exhaustion, or brute force attacks
-
testing against third-party services not operated by Billie
-
missing security headers
-
SPF, DKIM, or DMARC issues
-
version disclosures or banner grabbing
-
low-risk clickjacking
-
self-XSS
-
theoretical rate-limiting observations
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.