BMW Group Automotive
By BMW Group Bug bounty on Intigriti bmwgroup.com
- Top reward
- €15,000
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to €15,000
- for critical bugs, from €100.
- Report on Intigriti
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What Intigriti lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
€15,000 from €2,000 |
| High |
|
€5,000 from €1,000 |
| Medium |
|
€2,000 from €500 |
| Low |
|
€500 from €100 |
- Response
-
Within 2 days
| First Response | 2 days |
- Hall of fame
-
Yes
Critical and exceptional findings can earn you a place on our [BMW Security Hall of Fame](https://www.bmwgroup.com/de/general/Security.html).
Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test.
Hardware and IoT 2
- Functions dealing with vehicle access and immobilizer
- Remaining functions
Android apps 1
- de.bmw.connected.mobile20.row
iOS apps 1
- 1519034860
Rules
What the policy asks of you, and the bug types it won't reward, quoted from BMW Group Automotive (via Intigriti)'s policy. "We" in these lines means the program, not this site.
While testing
-
Research must be done using your own BMW products. You should not modify products owned by other BMW customers.
-
BMW is not responsible if you damage your product in any way during your research.
-
Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
-
We will not reimburse you for any costs related to proof of concepts (or else) created by the researcher.
-
Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)
Not accepted
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Denial of Service by flooding the ECU with bus messages or other inputs.
-
Software version disclosure / Banner identification issues.
-
Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 11 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
Functions dealing with vehicle access and immobilizer
-
Scope removed
de.bmw.connected.mobile20.row
-
Scope removed
1519034860
-
Scope removed
Remaining functions
-
Scope removed
Remaining functions
-
Scope removed
Functions dealing with vehicle access and immobilizer
-
Scope added
myBMW and myMini Apps
-
Scope removed
1519034860
-
Scope removed
de.bmw.connected.mobile20.row
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from www.intigriti.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
The BMW Group looks forward to working with the security community to find vulnerabilities in order to keep its products and customers safe and secure. We are committed to working with you to verify, reproduce, and respond to legitimate reported vulnerabilities covered by this policy. Within this program bounties can be received by reporting vulnerabilities that are in the scope of program and marked as “Eligible”. Please take note of the current scope outlined below.
Rules of engagement
Policies
By participating in this program, you agree to:
- Respect the Community Code of Conduct
- Respect the Intigriti Terms and Conditions
- Respect the scope of the program
- Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)
General Rules
- Research must be done using your own BMW products. You should not modify products owned by other BMW customers.
- BMW is not responsible if you damage your product in any way during your research.
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
- We will not reimburse you for any costs related to proof of concepts (or else) created by the researcher.
Response Targets
BMW Automotive Team will make a best effort to meet the following SLAs for hackers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | 2 days |
| Time to Triage | 4 days |
| Time to Bounty | 28 days |
| Time to Resolution | depends on severity and complexity |
We’ll try to keep you informed about our progress throughout the process.
Check our fix We offer up to €50 bonus to verify a resolved issue for us (when requested). This remains at the discretion of BMW to award.
In scope
The BMW Group values the work of security researchers in improving the security of our products and services and encourages the community to participate in its bug bounty program. We are committed to working with you to verify, reproduce, and respond to legitimate reported vulnerabilities covered by this policy. Within this program bounties can be received by reporting vulnerabilities that are in the scope of program.
Critical and exceptional findings can earn you a place on our BMW Security Hall of Fame.
Targets
The BMW Automotive Program aims at our automotive products, this includes besides BMW Group vehicles also our automotive related smartphone apps.
Out of scope
General
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
- Previously known vulnerable libraries without a working Proof of Concept.
- Denial of Service by flooding the ECU with bus messages or other inputs.
- Software version disclosure / Banner identification issues.
- Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
Duplicates
Vulnerabilities that were already known to the BMW Group through our own testing will be flagged as duplicate. Vulnerabilities that were already reported to the BMW Group will be flagged as duplicate.
During our transitional phase:
For vulnerabilities that have already been reported via our old program at HackerOne but have not yet been resolved, no new bounties will be paid out. These cases are examined individually by the triage team and us and, if applicable, will be closed with a corresponding notice. This problem will only exist during a transitional period.
Assets
- The eligibility of BMW Group aftermarket products is decided on a case-by-case basis
Severity
This program follows Intigriti's triage standards
FAQ
Where can we get credentials for the app?
We currently don’t offer any credentials to test user roles.