Commerzbank
By Commerzbank AG Vulnerability disclosure program on Self-hosted commerzbank.de
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 14
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Safe harbor
-
Partial
If you act in good faith and follow this Vulnerability Disclosure Policy, Commerzbank has no reason to report your research to law enforcement authorities.
- Hall of fame
-
Yes
To give credit where it is due, we have created a Hall of Fame thanking those individuals who have identified security gaps and reported them to us in a responsible manner.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 6 excluded.
Domains 4
- comdirect.de
- commerzbank.com
- commerzbank.de
- onvista-bank.de
Wildcard domains 4
- *.comdirect.de
- *.commerzbank.com
- *.commerzbank.de
- *.onvista-bank.de
Android apps 1
- Mobile apps published by Commerzbank AG
Products and areas 5
- Mobile apps published by Commerzbank AG
- Systems operated under AS15375
- Systems operated under AS16365
- Systems operated under AS17905
- Systems operated under AS22399
Out of scope (6)
- complaints about Commerzbank's service offering
- complaints or questions about the availability of our services
- questions on ATM terminals unless they relate to security vulnerabilities
- reports of fraud or suspected fraud, email scams or phishing emails
- reports of viruses or malware
- vulnerability reports that contain results from automated tools or scans, but lack explanatory documentation
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Commerzbank's policy. "We" in these lines means the program, not this site.
While testing
-
Do not use social engineering to gain access to our IT systems.
-
Your research must never interrupt our online and/or other services.
-
Your research must not result in the disclosure of Bank or client data.
-
Do not build backdoors into our systems, even if it would be just for the purpose of showing a security gap.
-
Do not make any changes, and do not delete data from our system.
-
Please do not provide any personal data that you obtained from our systems when submitting a report.
-
Do not use brute-force techniques to gain access to the system, i.e. repeated password guessing.
-
Run your tests as an unauthenticated user. Please do not use an account for your tests and do not create new accounts.
-
All findings should be accompanied by a proof of concept. We do not accept theoretical attacks.
-
Please do not publish your report.
Not accepted
-
DOS/DDoS
-
Brute force
-
Spam, email scams or phishing emails
-
Open TCP ports (unless they have specific weaknesses)
-
HTTP error messages such as status code 404 (exception: information disclosure in error messages)
-
Access to non-critical data that is already in the public domain, such as robots.txt
-
Clickjacking or potential clickjacking
-
Lack of optional features such as SPF, DKIM, DMARC, HPKP, etc.
-
Outdated versions of software or javascript libraries, with no ascertainable proof of concept exploit
-
Individual aspects of SSL/TLS configuration: lack of forward secrecy, SSL vulnerabilities that cannot be attacked remotely, weak cipher suites
-
Supposed vulnerabilities in HTTP header fields
-
The possibility to determine user names via brute force
-
HTTP OPTIONS method
-
Lack of CAPTCHAs
-
Lack of secure or HTTP-only flags for non-critical cookies
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.