Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Commerzbank AG

Vulnerability disclosure program on security.txt commerzbank.com

Accepting reports security.txt
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
13
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Partial safe harbor
Some legal protection; read the terms.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Safe harbor
Partial If you act in good faith and follow this Vulnerability Disclosure Policy, Commerzbank has no reason to report your research to law enforcement authorities.
Hall of fame
Yes To give credit where it is due, we have created a Hall of Fame thanking those individuals who have identified security gaps and reported them to us in a responsible manner.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

13 assets you may test, 6 excluded.

Domains 4

  • comdirect.de
  • commerzbank.com
  • commerzbank.de
  • onvista-bank.de

Wildcard domains 4

  • *.comdirect.de
  • *.commerzbank.com
  • *.commerzbank.de
  • *.onvista-bank.de

Products and areas 5

  • Mobile apps published by Commerzbank AG
  • Systems operated under AS15375
  • Systems operated under AS16365
  • Systems operated under AS17905
  • Systems operated under AS22399
Out of scope (6)
  • complaints about Commerzbank's service offering
  • complaints or questions about the availability of our services
  • questions on ATM terminals unless they relate to security vulnerabilities
  • reports of fraud or suspected fraud, email scams or phishing emails
  • reports of viruses or malware
  • vulnerability reports that contain results from automated tools or scans, but lack explanatory documentation

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Commerzbank AG's policy. "We" in these lines means the program, not this site.

While testing

  • Do not use social engineering to gain access to our IT systems.
  • Your research must never interrupt our online and/or other services.
  • Your research must not result in the disclosure of Bank or client data.
  • Do not build backdoors into our systems, even if it would be just for the purpose of showing a security gap.
  • Do not make any changes, and do not delete data from our system.
  • Please do not provide any personal data that you obtained from our systems when submitting a report.
  • Do not use brute-force techniques to gain access to the system, i.e. repeated password guessing.
  • Run your tests as an unauthenticated user. Please do not use an account for your tests and do not create new accounts.
  • All findings should be accompanied by a proof of concept. We do not accept theoretical attacks.

Not accepted

  • DOS/DDoS
  • Brute force
  • Spam, email scams or phishing emails
  • Open TCP ports (unless they have specific weaknesses)
  • HTTP error messages such as status code 404 (exception: information disclosure in error messages)
  • Access to non-critical data that is already in the public domain, such as robots.txt
  • Clickjacking or potential clickjacking
  • Lack of optional features such as SPF, DKIM, DMARC, HPKP, etc.
  • Outdated versions of software or javascript libraries, with no ascertainable proof of concept exploit
  • Individual aspects of SSL/TLS configuration: lack of forward secrecy, SSL vulnerabilities that cannot be attacked remotely, weak cipher suites
  • Supposed vulnerabilities in HTTP header fields
  • The possibility to determine user names via brute force
  • HTTP OPTIONS method
  • Lack of CAPTCHAs
  • Lack of secure or HTTP-only flags for non-critical cookies

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 3 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.