- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 0
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report through their form
- cert.org/vulnerability-analysis/vul-disclosure.cfm
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
We don't offer a bounty, just acknowledgement in our [Vulnerability Notes](www.kb.cert.org/vuls) and a sense of altruism.
- Hall of fame
-
Yes
We don't offer a bounty, just acknowledgement in our [Vulnerability Notes](www.kb.cert.org/vuls) and a sense of altruism.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
0 assets you may test, 1 excluded.
HackerOne does not list the scope of this program publicly. Check its policy.
Out of scope (1)
- cert.org web properties
Rules
What the policy asks of you, and the bug types it won't reward, quoted from CERT/CC (via HackerOne)'s policy.
Not accepted
-
XSS or CSRF in home router
-
Vulnerability affecting a single vendor with mature disclosure capabilities
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
The CERT/CC offers vulnerability coordination and disclosure services.
Misunderstanding, disagreement, or hard-to-reach vendor? Complicated supply chain, protocol vulnerability, multiple vendors involved? IoT, particularly with safety impact? Vendor is new to disclosure? Internet or other critical infrastructure affected? New or under-appreciated type of vulnerability? We can help.
XSS or CSRF in home router? Vulnerability affecting a single vendor with mature disclosure capabilities? Not so much, however we do recommend you make an attempt at coordinated disclosure.
We don't offer a bounty, just acknowledgement in our Vulnerability Notes and a sense of altruism.
For more information, please see our disclosure policy and wiki.
Please note: Currently we are not tracking reports using HackerOne and submitting a report will take you to our Vulnerability Reporting Form on cert.org. Our program is not meant for reports in cert.org web properties.