- Top reward
- $10,000
- Top severity paid
- Critical
- Assets in scope
- 66
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $10,000
- for critical bugs.
- Report through their form
- hackerone.com/dyson?type=team
- Replies within 5 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$10,000 |
| High |
|
$6,000 |
| Medium |
|
$4,000 |
| Low |
|
$2,000 |
- Response
-
Within 5 days
Time to first response (from report submit) - 5 business days.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
66 assets you may test, 32 excluded.
Web 60
- api.dyson.at Critical
- api.dyson.be Critical
- api.dysoncanada.ca Critical
- api.dyson.ch Critical
- api.dyson.com Critical
- api.dyson.co.uk Critical
- api.dyson.de Critical
- api.dyson.dk Critical
- api.dyson.es Critical
- api.dyson.fr Critical
- api.dyson.ie Critical
- api.dyson.it Critical
- api.dyson.nl Critical
- api.dyson.no Critical
- api.dyson.pt Critical
- api.dyson.se Critical
- api.fi.dyson.com Critical
- shop.dyson.co.za Critical
- shop.dyson.tw Critical
- www.dyson.ae Critical
- www.dyson.at Critical
- www.dyson.be Critical
- www.dysoncanada.ca Critical
- www.dyson.ch Critical
- www.dyson.cn Critical
- www.dyson.co.il Critical
- www.dyson.co.jp Critical
- www.dyson.co.kr Critical
- www.dyson.com Critical
- www.dyson.com.au Critical
- www.dyson.com.ee Critical
- www.dyson.com.mx Critical
- www.dyson.com.ro Critical
- www.dyson.com.sg Critical
- www.dyson.com.tr Critical
- www.dyson.com.ua Critical
- www.dyson.co.nz Critical
- www.dyson.co.th Critical
- www.dyson.co.uk Critical
- www.dyson.cz Critical
- www.dyson.de Critical
- www.dyson.dk Critical
- www.dyson.es Critical
- www.dyson.fr Critical
- www.dyson.hk Critical
- www.dyson.hu Critical
- www.dyson.ie Critical
- www.dyson.in Critical
- www.dyson.it Critical
- www.dyson.my Critical
- www.dyson.nl Critical
- www.dyson.no Critical
- www.dyson.pl Critical
- www.dyson.pt Critical
- www.dyson.se Critical
- www.dyson.tw Critical
- www.dyson.vn Critical
- www.fi.dyson.com Critical
- www.gr.dyson.com Critical
- www.sa.dyson.com Critical
Android apps 1
- com.dyson.mobile.android Critical
Hardware and IoT 1
- Dyson Connected Products (IoT Hardware) Critical
iOS apps 1
- 993135524 Critical
Wildcard domains 1
- *.cp.dyson.com Critical
Products and areas 2
- Github findings High
- Other Dyson Assets High
Out of scope (32)
- 30secondbleeps.com
- aio.shop.china-dyson.com
- api.q.dyson.cn
- auth.dysonrecall.com
- bounce.dyson*
- careers.dyson.com
- *central.dyson.com
- central-test.dyson.com
- centraltest.dyson.com
- comm.dyson*
- community.dyson.com
- dysontherapie.fr
- fsc.dyson.com
- jamesdysonfoundation.*
- jobs.dyson.com
- mail.register-dyson.co.kr
- m.shop.dyson.cn
- on.dyson.co.uk
- q.dyson.cn
- register-dyson.co.kr
- reviews.dyson*
- sakti3.com
- shop.dyson.co.kr
- shop.dyson.ru
- sm2.dyson.com
- sm3.dyson.com
- svn.dyson.com
- test.oepay.dyson.cn
- view.dyson.com
- www.dyson.ovh
- *.dynsystem.kr
- *dyson-demo.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Dyson (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Social engineering techniques (e.g. phishing, vishing, smishing) of Dyson employees or users are strictly prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Be respectful when interacting with our team, our team will do the same.
-
Do not intentionally harm the experience or usefulness of the service to others, including degradation of services and denial of service attacks.
-
Performing tests against accounts belonging to Dyson employees or customers is prohibited. Only interact with accounts you have created or with explicit permission of the account holder.
-
Any physical attacks against Dyson property or data centers are not permitted.
-
Include a custom HTTP header in all your traffic of the format **X-Hackerone: <Username>**
Not accepted
-
Reports generated using automated scanning tools
-
Newly disclosed "0-day" or "zero-day" vulnerabilities, publicised less than a month prior
-
Issues without clearly identified security impact, such as clickjacking on a static website, missing security headers, or descriptive error messages
-
Vulnerabilities only affecting users of outdated or unpatched browsers and platforms
-
Issues related to software or protocols not under Dyson control
-
Clickjacking or lack of X-Frame-Options on pages without an authenticated, state-changing action
-
CSRF on non-sensitive actions, such as login, logout, adding items to a shopping cart etc.…
-
Username/Email Enumeration
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Missing best practices in SSL/TLS configuration.
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Brute-forcing coupon codes.
-
Lack of secure/HTTP Only flags for non-sensitive data.
-
Banner grabbing issues.
-
Bugs requiring exceedingly unlikely user interaction (e.g., requiring a user to manually type in an XSS payload)
-
Social Media account takeovers
-
We know of the SPF issues; there is an ongoing project to rectify this, so do not submit email spoofing reports.
-
Credentials submitted from the sources of Dark Web.
-
Rate Limiting Bugs on Password Reset Endpoints.
-
Reports related to Outdated/Old links will not be eligible for a reward and will be considered as N/A.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 4 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
api.dyson.pt
-
Scope added
api.dyson.se
-
Scope added
www.dyson.se
-
Scope added
www.dyson.tw
-
Scope added
www.dyson.vn
-
Scope added
api.dyson.nl
-
Scope added
*.dynsystem.kr (out of scope)
-
Scope added
*central.dyson.com (out of scope)
-
Scope added
*dyson-demo.com (out of scope)
-
Scope added
30secondbleeps.com (out of scope)
-
Scope added
aio.shop.china-dyson.com (out of scope)
-
Scope added
api.q.dyson.cn (out of scope)
-
Scope added
auth.dysonrecall.com (out of scope)
-
Scope added
bounce.dyson* (out of scope)
-
Scope added
careers.dyson.com (out of scope)
-
Scope added
central-test.dyson.com (out of scope)
-
Scope added
centraltest.dyson.com (out of scope)
-
Scope added
comm.dyson* (out of scope)
-
Scope added
community.dyson.com (out of scope)
-
Scope added
dysontherapie.fr (out of scope)
-
Scope added
fsc.dyson.com (out of scope)
-
Scope added
jamesdysonfoundation.* (out of scope)
-
Scope added
jobs.dyson.com (out of scope)
-
Scope added
m.shop.dyson.cn (out of scope)
-
Scope added
mail.register-dyson.co.kr (out of scope)
-
Scope added
on.dyson.co.uk (out of scope)
-
Scope added
q.dyson.cn (out of scope)
-
Scope added
register-dyson.co.kr (out of scope)
-
Scope added
reviews.dyson* (out of scope)
-
Scope added
sakti3.com (out of scope)
-
Scope added
shop.dyson.co.kr (out of scope)
-
Scope added
shop.dyson.ru (out of scope)
-
Scope added
sm2.dyson.com (out of scope)
-
Scope added
sm3.dyson.com (out of scope)
-
Scope added
svn.dyson.com (out of scope)
-
Scope added
test.oepay.dyson.cn (out of scope)
-
Scope added
view.dyson.com (out of scope)
-
Scope added
www.dyson.ovh (out of scope)
-
Scope added
Github findings
-
Scope added
api.dyson.no
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Dyson Bug Bounty Program
Dyson takes the security of its customers, employees, and technology very seriously. Whilst we build our systems to be as robust as possible, we greatly value the support of security experts around the world in helping us identify and eliminate any weaknesses. To recognize these efforts and the key role security researchers play in keeping Dyson secure we offer a bounty for reporting certain qualifying security vulnerabilities. Please make sure you review and understand the program policy before submitting a report.
If you think you have found a security flaw, we welcome the chance to work with you – and reward you – to resolve the issue.
How we’ll thank you
To show our appreciation for taking the time to help keep us secure, Dyson may provide cash rewards for qualifying vulnerabilities. We will work with you to determine the impact on our company, so submissions with detailed explanations and screenshots alongside the impact you believe it faces on Dyson will go a long way to ensure that we both agree what the impact is. As a large company with many moving parts, it can take time for us to remediate vulnerabilities, especially when they involve many components or 3rd parties.
Program Rules
The scope for Dyson’s Bug Bounty program includes most of our assets and products. If it is not out of scope, and it is impactful to us or our customers, we want to hear about it. Please note that issues without security impact submitted to our program will be closed out - please review our out-of-scope section before submitting. By submitting a report or otherwise disclosing a vulnerability to us, you are indicating that you have read and agreed to follow the rules outlined in this policy. To ensure Dyson maintains its high level of reputation, and to keep ourselves and our customers safe, we ask you to adhere to the below rules when testing:
• Social engineering techniques (e.g. phishing, vishing, smishing) of Dyson employees or users are strictly prohibited. • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. • Be respectful when interacting with our team, our team will do the same. • Do not intentionally harm the experience or usefulness of the service to others, including degradation of services and denial of service attacks. • Performing tests against accounts belonging to Dyson employees or customers is prohibited. Only interact with accounts you have created or with explicit permission of the account holder. • Any physical attacks against Dyson property or data centers are not permitted. • Include a custom HTTP header in all your traffic of the format X-Hackerone:
Report & Bounty Eligibility
We appreciate every researcher who submits valid issues to us as it allows us to improve the security of our company and our products. To qualify for a reward, and to ensure that we can continue to have a working relationship you must: • Be the first reporter of the vulnerability. • Submit a vulnerability within our Scope. • Demonstrate a security impact to an asset or application in scope. • Follow Hacker One’s disclosure guidelines. • Have a working POC outlining the security implications for your report. • Not have publicly disclosed the vulnerability without our consent. • Not be employed by Dyson or any of its affiliates or an immediate family member of a person employed by Dyson or any of its affiliates. • Provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward. • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. • Not be using duplicate Hacker One accounts. • Subdomain takeover vulnerabilities will be triaged as low severity across all asset categories. If the researcher is unable to demonstrate an actual takeover, the bounty awarded will be reduced by 50%. Furthermore, rewards for subdomain takeover findings will only be issued in cases where a practical takeover is demonstrably achievable within the given scenario. • All the reports related to "Promo-Code /Coupon Code / Free Shipping " vulnerabilities will be considered as Informative or N/A across all asset categories. These issues are not eligible for bounty or further triage. • Open redirects will be considered as Informative across all asset categories.
Please note that multiple vulnerabilities caused by one underlying issue will be awarded one bounty. In the event of duplicates, we only award the first report that was received (provided that it can be fully reproduced). Before submitting an issue on an asset, make sure it is not listed in the out-of-scope section. Vulnerabilities reported on out-of-scope assets will be closed as N/A.
Reporting guidelines & tips
- Please submit reports in plaintext, not via an attached file like DOC or PDF.
- Please only submit one issue per report – this ensures you will receive credit for each issue and avoids delays in processing your report.
- Quality matters – please make it clear what you are reporting and what the impact is. Higher quality reports help us quickly understand the issue, reduce the need for back-and-forth, and can therefore result in higher pay-outs.
- Provide detailed written steps on how to reproduce your issue.
- Before assigning a severity, please consider exactly how it impacts the security or privacy of Dyson users or systems, how an attacker could exploit, and how it could be fixed.
- Please fill out every section and questions on the report as this will facilitate the triage process, thus avoiding delays.
- For reports on assets that fall within the other assets category, please provide additional information and indicators suggesting why the asset belongs to Dyson.
If the vulnerability is particularly complex, including a video may be helpful – but please do not submit a report that is only a video. General software bugs that do not represent any security risk or are excluded from our program can be reported via email to [email protected]. Additionally, if unsure whether a domain belongs to Dyson please contact the aforementioned email address for clarification.
At this time Dyson is not permitting public disclosure of submitted reports.
Guidance on AI-Generated Reports
We’ve noticed a rise in reports created entirely by AI that lack practical value. While AI can help improve clarity and organization, reports must include your own analysis, testing, or insights to meet our standards. Submissions that appear fully automated and lack genuine human contribution will be rejected. We expect thoughtful research, solid evidence, and analytical thinking—AI should assist, not replace, your work.
Engagement and Resolution Timeframes
If you discover a potential security problem in our products, applications or websites. Please let us know as soon as possible.
Dyson will make a best effort to meet the following SLAs for hackers participating in our program:
- Time to first response (from report submit) - 5 business days.
- Time to triage (from report submit) - 10 business days.
- Time to bounty (from triage) - 30 business days
- Time to resolution (from triage) - 30 business days (Low and Medium issues may require more time)
Qualifying Vulnerabilities
Any design or implementation issue that is reproducible and substantially affects the security of Dyson is likely to qualify.
When in doubt whether we would consider a vulnerability for a reward, map out the impact the vulnerability would have to Dyson or Dyson’s customers.
Reflected cross-site scripting
We encourage you to increase the severity of your reflected cross-site scripting/open redirect findings by going beyond the traditional alert (1) pop-up or a redirection to google.com.
- Reflected cross-site scripting reports without additional demonstrated impact (e.g. account takeovers) will be set to low severity.
Non-Qualifying Vulnerabilities
Please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
- Reports generated using automated scanning tools
- Newly disclosed "0-day" or "zero-day" vulnerabilities, publicised less than a month prior
- Issues without clearly identified security impact, such as clickjacking on a static website, missing security headers, or descriptive error messages
- Vulnerabilities only affecting users of outdated or unpatched browsers and platforms
- Issues related to software or protocols not under Dyson control
- Clickjacking or lack of X-Frame-Options on pages without an authenticated, state-changing action
- CSRF on non-sensitive actions, such as login, logout, adding items to a shopping cart etc.…
- Username/Email Enumeration
- Attacks requiring MITM or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept.
- Comma Separated Values (CSV) injection without demonstrating a vulnerability.
- Missing best practices in SSL/TLS configuration.
- Any activity that could lead to the disruption of our service (DoS). All reports related to "Lack of rate-limiting" or "Rate Limiting" related vulnerabilities will be considered as Out Of Scope.
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Brute-forcing coupon codes.
- Lack of secure/HTTP Only flags for non-sensitive data.
- Banner grabbing issues.
- Bugs requiring exceedingly unlikely user interaction (e.g., requiring a user to manually type in an XSS payload)
- Social Media account takeovers
- We are aware the S3 software update repository (software.dyson.com) can be enumerated, but the binary images within should be encrypted. We would love to hear if they aren’t, or they can be unencrypted!
- We know of the SPF issues; there is an ongoing project to rectify this, so do not submit email spoofing reports.
- Credentials submitted from the sources of Dark Web.
- Rate Limiting Bugs on Password Reset Endpoints.
- Reports related to Outdated/Old links will not be eligible for a reward and will be considered as N/A.
- Reports of cache poisoning vulnerabilities that rely on the use of "cachebusters"—such as unique or random query parameters appended to resource URLs in order to trigger the cache poisoning—are not eligible for bounty consideration. Only reports demonstrating a cache poisoning impact against default or standard asset URLs, without the need to manipulate the URL with arbitrary or non-standard parameters, will be considered within scope.
Non-Qualifying Vulnerabilities (IoT Hardware)
The following bugs relating to IoT Hardware are unlikely to be eligible for a bounty:
- We are aware that Bluetooth on the device is constantly on, this was a design decision.
- We are aware of the availability of some debug/serial interfaces on certain components within the product. Whilst the discovery of these interfaces will not be eligible for bounty payments, any sensitive data yielded or manipulations you can perform over said interfaces will be.
- Local network flooding that causes devices to stop responding for a brief period of time.
- We are aware that in some Dyson products, direct communication traffic (MQTT) between a mobile device and the product which is routed over a secured Wi-Fi network is not encrypted.
Our fine print
The information on this page is intended only for security researchers. If you’d like to know more about our security and data privacy, please see our Privacy website
#The Dyson Responsible Disclosure Program Dyson takes the security of its customers, employees and technology very seriously. Whilst we build our systems to be as robust as possible, we greatly value the support of security experts around the world in helping us identify and eliminate any weaknesses.
If you think you've found a security flaw, we welcome the chance to work with you to resolve the issue.
The information on this page is intended only for security researchers. If you’d like to know more about our security and data privacy, please see our Privacy website.
Disclosure policy: how you can help us
If you discover a potential security problem in our products, applications or websites, please let us know as soon as possible. We will endeavor to acknowledge your correspondence within 72 hours and provide regular updates to you about progress.
Finally, please make every effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
Bug Bounty Program
Dyson currently runs a Bug Bounty program on Hacker One, if you wish to submit a new report via the program, do so here:
https://hackerone.com/dyson?type=team
#Vulnerability Disclosure Program
Dyson currently run a Vulnerability Disclosure Program, if you wish to submit a new report via the program, please email [email protected]. Please note: we do not pay bounties for issues reported to us outside of our Bug Bounty program.