Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Emirates NBD Bank PJSC

Vulnerability disclosure program on security.txt emiratesnbd.com

Accepting reports Full safe harbor security.txt
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
5
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 1 day
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No Regrettably, we do not currently offer a paid Bug Bounty program.
Response
Within 1 days this is usually within 24 hours of your report being received.
Safe harbor
Full your research will be considered as authorized, and the Emirates NBD Group will neither pursue nor recommend initiating legal action pertaining to the conducted research.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

5 assets you may test, 2 excluded.

Domains 2

  • emiratesnbd.com
  • emiratetesislamic.com

Wildcard domains 2

  • *.emiratesnbd.com
  • *.emiratetesislamic.com

Products and areas 1

  • any other international domain/subdomains which are managed and maintained by Emirates NBD
Out of scope (2)
  • systems belonging to any third party
  • Third-party Services

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Emirates NBD Bank PJSC's policy. "We" in these lines means the program, not this site.

While testing

  • Test systems different from those mentioned in the section “Scope”
  • Attempt non-technical testing such as physical (e.g., tailgating, office access etc.) or social engineering (e.g., phishing vishing etc.) involving customers or employees.
  • Upload of any vulnerability or client-related content to third-party platforms (e.g., GitHub, DropBox, YouTube).
  • Test Third-party Services.
  • Dive deeper to determine how much more is accessible if your able access to a system, accounts, users, or user data, stop at point of recognition and report.
  • Breach any applicable laws in connection with our services or products, your report, or your interaction with Emirates NBD Group.
  • Engage in any disruptive testing like Denial of Service or Distributed Denial of Service (DoS/DDoS)
  • Access unnecessary amounts of data. For example, 2 or 3 records is enough to demonstrate most vulnerabilities
  • Violate the privacy of Emirates NBD Group’s customers, users, staff, contractors, systems etc.
  • Disclose any vulnerabilities you found in Emirates NBD Group’s systems or services to third parties or the public until Emirates NBD Group confirms that those vulnerabilities have been fixed.

Not accepted

  • TLS configuration weaknesses (e.g., "weak" cipher suite support, TLS1.0 support, sweet32 etc.)
  • SSL/TLS best practices that do not contain a fully functional proof of concept
  • Host header injection where the resulting impact is minimal.
  • Network data enumeration techniques (e.g., banner grabbing, existence of publicly available server diagnostic pages)
  • Google Maps API Keys
  • Account/e-mail enumeration using brute-force attacks
  • Clickjacking/UI redressing
  • Client-side application/browser autocomplete or saved password/credentials
  • Descriptive or verbose error pages without proof of exploitability or obtaining sensitive information
  • Issues related to password/credential strength, length, lock outs, or lack of brute-force/rate limiting protections
  • Low impact Information disclosures (including Software version disclosure)
  • Missing Cookie flags
  • Missing/Enabled HTTP Headers/Methods which do not lead directly to a security vulnerability
  • Heartbleed requires a valid POC which shows sensitive data leakage.
  • POODLE requires a POC demonstrating a downgrade, not just the result of SSLScan or Nmap scan.
  • Use of a known-vulnerable library which leads to a low-impact vulnerability
  • Vulnerabilities affecting users of outdated browsers, plugins, or platforms
  • Vulnerabilities that allow for the injection of arbitrary text without allowing for hyperlinks, HTML, or JavaScript code to be injected
  • Vulnerabilities that require the user/victim to perform extremely unlikely actions (i.e., Self-XSS)

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 12 Nov 2026. Last checked 3 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.