Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Danske Bank

Vulnerability disclosure program on Self-hosted danskebank.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
7
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No Please also be aware, that we do not provide monetary rewards, discounts, or any other forms of compensation for your report.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

7 assets you may test, 2 excluded.

Domains 6

  • danskebank.com
  • danskebank.com (no subdomains)
  • danskebank.dk
  • danskebank.dk (no subdomains)
  • june.dk No bounty
  • sunday.dk No bounty

iOS apps 1

  • eBanking 3.0
Out of scope (2)
  • our end users
  • Social engineering

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Danske Bank's policy. "We" in these lines means the program, not this site.

While testing

  • Do not intentionally access non-public Danske Bank data any more than is necessary to demonstrate the vulnerability
  • Do not permanently modify or delete Danske Bank hosted data
  • Do not DDoS or otherwise disrupt, interrupt or degrade our internal or external services
  • Do not put a backdoor in the system, not even for the purpose of showing the vulnerability
  • Do not share confidential information obtained from Danske Bank
  • Social engineering is out of scope. Do not send phishing emails to, or use other social engineering techniques against, anyone, including Danske Bank staff, members, vendors, or partners
  • Do not utilise any brute-force techniques (e.g. repeatedly entering passwords) in order to gain access to the system
  • Do not attack, in any way, our end users, or engage in trade of stolen user credentials. However, should you become aware of such trade, we would certainly appreciate being informed
  • When you report a vulnerability to us, please encrypt your message using this PGP Key .

Not accepted

  • Any vulnerabilities without a properly described evidence report of proof of possible exploitation
  • Reports generated by automated scan tools (e.g. Nmap scan results)
  • Our policies on presence or absence of SPF/DKIM/DMARC records or Cross Site Request Forgery (CSRF) vulnerabilities on unauthenticated pages
  • HTML character set vulnerabilities such as “does not specify” or “unrecognized”
  • Lack of secure/HTTP Only flags on non-sensitive cookies
  • Absence of using HTTP Strict Transport Security (HSTS)
  • Clickjacking or the non-existence of X-Frame-Options on non-logon pages
  • Cacheable HTTPS response pages on sites that do not provide money transfer capabilities
  • Reports of insecure SSL/TLS ciphers
  • Vulnerabilities which require a jailbroken mobile device, unless they enable a server-side compromise

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.