- Top reward
- €3,000
- Top severity paid
- Critical
- Assets in scope
- 8
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to €3,000
- for critical bugs, from €50.
- Report on YesWeHack
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 5 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What YesWeHack lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
€3,000 |
| High |
|
€1,000 |
| Medium |
|
€300 |
| Low |
|
€50 |
- Response
-
Within 5 days
Please allow 5 working days for our initial response.
- Safe harbor
-
Partial
We ask you to make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research.
Summarised with AI from the program policy on YesWeHack, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
8 assets you may test, 2 excluded.
APIs 4
- https://api-app.datadome.co
- https://api.datadome.co
- https://api-js.datadome.co
- https://customer-api.datadome.co
Web 4
- https://app.datadome.co
- https://auth.datadome.co
- https://*.captcha-delivery.com
- https://datadome.co
Out of scope (2)
- All domains not listed In-Scope
- Third-party widgets on www.datadome.co and app.datadome.co
Rules
What the policy asks of you, and the bug types it won't reward, quoted from DataDome Bug Bounty (via YesWeHack)'s policy. "We" in these lines means the program, not this site.
While testing
-
Denial of service (DoS) attacks on DataDome applications, servers, networks or infrastructure are strictly forbidden.
-
Avoid tests that could cause degradation or interruption of our services.
-
Do not use automated scanners or tools that generate a large amount of network traffic.
-
Only perform tests against your own accounts to protect our users' privacy.
-
Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
-
Do not copy any files from our applications/servers and disclose them.
-
No vulnerability disclosure, full, partial or otherwise, is allowed.
-
no data alterations are allowed inside DataDome infrastructure or on DataDome customer Cloud infrastructure
Not accepted
-
Any hypothetical flaw or best practices without exploitable POC
-
Unverified results of automated tools or scanners
-
Missing security-related HTTP headers which do not lead directly to a vulnerability
-
Mixed content warnings
-
Vulnerabilities that are already publicly known or variations of such
-
Vulnerabilities on other products or services than listed above
-
Issues in our DNS, NTP or SMTP
-
DNS Dangling or SubDomain takeover without a real exploitable POC
-
Clickjacking/UI redressing
-
Software version disclosure without a real exploitable POC
-
Stack traces or path disclosure without a real exploitable POC
-
Vulnerabilities affecting outdated browsers or platforms
-
Issues that require physical access to a victim’s computer/device
-
Logout and other instances of low-severity Cross-Site Request Forgery
-
Bot detection capability
-
Brute-force attack
-
DataDome cookie doesn't have the secure flag
-
Using old TLS configuration on "Protection API" (needed for retro-compatibility with DataDome module installed)
-
Social engineering of DataDome employees and contractors
-
Attack against DataDome office (malware, backdoor, DoS, …)
-
Denial of service attacks
-
DMARC vulnerabilities on datadome.co mail
-
CSV injection vulnerabilities
-
3rd parties security issues (Auth0, Readme.com...)
Summarised with AI from the program policy on YesWeHack, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from yeswehack.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Rules
Scope
The scope of the bug bounty is :
| Function | Domain |
|---|---|
| Customer Dashboard | app.datadome.co |
| Customer Dashboard - API | api-app.datadome.co |
| Customer API | customer-api.datadome.co |
| Java Script | js.datadome.co |
| Captcha | *.captcha-delivery.com |
| Server Site API used by modules | api.datadome.co |
| Client Side API used by JS or SDK | api-js.datadome.co |
| Corporate Site | datadome.co or www.datadome.co |
| Server-Side modules (in customer infrastructure) | docs.datadome.co |
| Authentication | auth.datadome.co |
You can find all the information you need about DataDome on https://docs.datadome.co/docs readme.com third-party is out of scope
auth.datadome.co is managed by Auth0 Third-Party, only DataDome direct vulnerability will be rewarded
Keep in mind this is a production environment, no data alterations are allowed inside DataDome infrastructure or on DataDome customer Cloud infrastructure, and, therefore, you must not affect the availability of the platform.
Testing Policy and Responsible Disclosure:
Please adhere to the following rules while performing research on this program:
- Denial of service (DoS) attacks on DataDome applications, servers, networks or infrastructure are strictly forbidden.
- Avoid tests that could cause degradation or interruption of our services.
- Do not use automated scanners or tools that generate a large amount of network traffic.
- Only perform tests against your own accounts to protect our users' privacy.
- Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
- Do not copy any files from our applications/servers and disclose them.
- No vulnerability disclosure, full, partial or otherwise, is allowed.
Proof of exploitation:
- Raw HTTP requests and responses are mandatory for every report. For each step of the exploit chain, you must provide the full request and response captured via Burp Suite, OWASP ZAP, curl, or any equivalent tool. This includes the method, endpoint, relevant headers, request body, status code, and response body confirming the impact. You may redact session cookies and any data not relevant to the vulnerability. Reports missing this evidence will be triaged as "Incomplete" until provided.
- Provide clear, step-by-step reproduction instructions with all necessary payloads, parameters, and commands.
- Screenshots showing the final impact are strongly appreciated.
- A PoC video demonstrating the full exploit chain is a welcome bonus.
Reward Eligibility:
We are happy to thank everyone who submits valid reports which help us improve the security of DataDome, however only those that meet the following eligibility requirements may receive a monetary reward:
- You must be the first reporter of a vulnerability.
- The vulnerability must be a qualifying vulnerability (see below).
- The report must contain the following elements:
- Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and DataDome, and remediation advice on fixing the vulnerability.
- You must not break any of the testing policy rules listed above
- You must not be a former or current employee of DataDome or one of its contractors.
Our security team will review each committed finding and establish communication as soon as possible to reproduce and solve the reported vulnerability. Please allow 5 working days for our initial response. We ask you to make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research.
Out of scope
- All domains not listed In-Scope
- Third-party widgets on www.datadome.co and app.datadome.co
Qualifying vulnerabilities
- Broken Authentication and Session Management
- Cross-Site Scripting (XSS), Cross-site Request Forgery (CSRF), Server-Side Request Forgery (SSRF)
- SQL Injection
- Remote Code Execution (RCE)
- Directory Traversal Issues / Local File Disclosure
- Breach in the multi-tenant system (eg : Sensitive Data Exposure)
- Security Misconfiguration
- Missing Function Level Access Control
Non-qualifying vulnerabilities
- Any hypothetical flaw or best practices without exploitable POC
- Unverified results of automated tools or scanners
- Missing security-related HTTP headers which do not lead directly to a vulnerability
- Mixed content warnings
- Vulnerabilities that are already publicly known or variations of such
- Vulnerabilities on other products or services than listed above
- Issues in our DNS, NTP or SMTP
- DNS Dangling or SubDomain takeover without a real exploitable POC
- Clickjacking/UI redressing
- Software version disclosure without a real exploitable POC
- Stack traces or path disclosure without a real exploitable POC
- Vulnerabilities affecting outdated browsers or platforms
- Issues that require physical access to a victim’s computer/device
- Logout and other instances of low-severity Cross-Site Request Forgery
- Issues not leading to a confidentiality, traceability or integrity problem. You can report it to [email protected] This can help you to have a better experience and help you in your research
- Bot detection capability
- Brute-force attack
- DataDome cookie doesn't have the secure flag
- Using old TLS configuration on "Protection API" (needed for retro-compatibility with DataDome module installed)
- Social engineering of DataDome employees and contractors
- Attack against DataDome office (malware, backdoor, DoS, …)
- Denial of service attacks
- DMARC vulnerabilities on datadome.co mail
- CSV injection vulnerabilities
- 3rd parties security issues (Auth0, Readme.com...)