Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Ferrero

By Ferrero International S.A. Vulnerability disclosure program on HackerOne ferrero.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
414
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Safe harbor
Full If we conclude, in our sole discretion, that you have complied with the requirements above when reporting a security vulnerability, Ferrero will not pursue claims against you or initiate a law enforcement investigation in response to your report:
Hall of fame
Yes be listed on Ferrero’s HackerOne webpage under “Hackers Thanked.”

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

414 assets you may test.

Web 386

  • backtoschool2024.ferreropromo.it Critical No bounty
  • caraffa2024.ferreropromo.it Critical No bounty
  • figurine2024.ferreropromo.it Critical No bounty
  • fulfil-promo.de Critical No bounty
  • ge63-ferreropp.web.oxv.fr Critical No bounty
  • http://backtoschool25.ru Critical No bounty
  • http://duplo-chocnut.de/gratistesten Critical No bounty
  • http://estathe.it Critical No bounty
  • http://fandom.kinder.com/strangerthings Critical No bounty
  • http://kinder.com/de/de/xp/magische-bescherung Critical No bounty
  • http://kinderkarnawal.pl/admin_bn5cz9k4/login Critical No bounty
  • http://quality-ksb-onepiecenetflix-de-2026.ipaasferrero.com/de/de/xp/ksb-onepiecenetflix Critical No bounty
  • http://quality-songsmitherz-de-2026.ipaasferrero.com/de/de/xp/songsmitherz Critical No bounty
  • https://2627.quellidellacolazione.it Critical No bounty
  • https://5cc1659edaa8.hosting.myjino.ru Critical No bounty
  • https://accendilefesteestatheedamici.estathe.it Critical No bounty
  • https://admin.loteria.ferrerorocher.pl Critical No bounty
  • https://admin.t.blask.ferrerorocher.pl Critical No bounty
  • https://admin.tictacph.com Critical No bounty
  • https://aldomain1.raffaello.hu/hu/hu/xp/dobozbazartszeretet Critical No bounty
  • https://apd-talking-ap-southeast-1.applaydu.com/bff Critical No bounty
  • https://apd-talking-eu-west-1.applaydu.com/bff Critical No bounty
  • https://apd-talking-staging-ap-southeast-1.applaydu.com/bff Critical No bounty
  • https://apd-talking-staging-eu-west-1.applaydu.com/bff Critical No bounty
  • https://baltic.ferrerorocher.com/lv/lv/xp/aygt25 Critical No bounty
  • https://baltic.ferrerorocher.com/lv/lv/xp/gold Critical No bounty
  • https://baltic.kinder.com/lv/lv/xp/bueno Critical No bounty
  • https://baltic.kinder.com/lv/lv/xp/karnevals Critical No bounty
  • https://baltic.kinder.com/lv/lv/xp/loterija Critical No bounty
  • https://baltic.kinder.com/regs Critical No bounty
  • https://baltic.nutella.com/bc/lv/edit Critical No bounty
  • https://baltic.nutella.com/bc/lv/xp/labrit Critical No bounty
  • https://baltic.nutella.com/bc/lv/xp/loterija Critical No bounty
  • https://baltic.nutella.com/bc/lv/xp/maize Critical No bounty
  • https://beta.nutellakochapieczywo.nutella.com Critical No bounty
  • https://beta.nutellakochapieczywo.nutella.com/admin_9anga7jr3 Critical No bounty
  • https://beta.nutellaxmas.4ourclient.com/pl/pl/xp/dzielsiemiloscianaswieta2025 Critical No bounty
  • https://beta.tictac.4ourclient.com/admin_p3bav5a1b Critical No bounty
  • https://beta.tictac.4ourclient.com/pl/pl/xp/znajdzswojsmak2025 Critical No bounty
  • https://clubferreropro.com Critical No bounty
  • https://cms-aygt-fr-2025.ferrerorocherpromo.com/fr/fr/xp/ajoutez-votre-touche-de-magie Critical No bounty
  • https://cms-aygt-it-2025.ferrerorocherpromo.com/it/it/xp/natale2025 Critical No bounty
  • https://cms-aygt-master-2025.ferrerorocherpromo.com Critical No bounty
  • https://cms-aygt-mx-2025.ferrerorocherpromo.com/mx/es/xp/que-tus-momentos-brillen Critical No bounty
  • https://cms-kinderriegel-love-de-2025.ipaasferrero.com/de/de/xp/kinderriegel-love/admin Critical No bounty
  • https://cms-kinderviaggiesercenti2025-ferreroprofessional-it-2025.ipaasferrero.com/user/login Critical No bounty
  • https://cms-kjeldsens-com-2025.ipaasferrero.com Critical No bounty
  • https://cms-ksbcavengers-in-2026.ipaasferrero.com/in/en/xp/ksbcavengers/user/login Critical No bounty
  • https://cms-nutella-academy-fr-2025.ferreropromo.com/fr/fr/xp/academy-event Critical No bounty
  • https://cms-personalised-nutella-jar-int-2025.ipaasferrero.com/uk/en/xp/personalised-nutella-jar Critical No bounty
  • https://cms-pingui-win-uk-2026.ipaasferrero.com/uk/en/xp/pingui-win/user Critical No bounty
  • https://cmsquality-golden-ticket-de-2026.ipaasferrero.com/de/de/xp/golden-ticket/user/login Critical No bounty
  • https://cmsquality-golden-ticket-uk-2026.ipaasferrero.com/uk/uk/xp/golden-ticket/user/login Critical No bounty
  • https://cmsquality-golden-ticket-us-2026.ipaasferrero.com/us/en/xp/golden-ticket/user/login Critical No bounty
  • https://cmsquality-ticket-d-or-fr-2026.ipaasferrero.com/fr/fr/xp/ticket-d-or/user/login Critical No bounty
  • https://cmsquality-vinciwonka2026-it-2026.ipaasferrero.com/it/it/xp/vinciwonka2026/user/login Critical No bounty
  • https://cmsquality-wonka-com-2026.ipaasferrero.com Critical No bounty
  • https://cmsquality-wonka-us-2026.ipaasferrero.com/uk/user Critical No bounty
  • https://cmsquality-xmas-com-2026.ipaasferrero.com/uk/en/xp/nutella-christmas Critical No bounty
  • https://cms.tennistrophy.com Critical No bounty
  • https://cms.tennistrophy.it Critical No bounty
  • https://cms-wonka-com-2026.ipaasferrero.com Critical No bounty
  • https://development.winwiththorntons.co.uk Critical No bounty
  • https://estathebacktowork26.estathe.it Critical No bounty
  • https://estathecanoa26.estathe.it Critical No bounty
  • https://estathefornopizza26.estathe.it Critical No bounty
  • https://eventi.ferrero.it Critical No bounty
  • https://ferrero-aygt.vercel.app Critical No bounty
  • https://ferrero-egypt.vercel.app Critical No bounty
  • https://ferrero-egypt.vercel.app/secure-ops-98423 Critical No bounty
  • https://ferrero-hom.comuniclick.com.br Critical No bounty
  • https://ferrero-hom.comuniclick.com.br/_/admin/login Critical No bounty
  • https://ferrero-palette-2025-netlify-app.ferrero.fr/status/_id/uid Critical No bounty
  • https://ferrerorocher-aygt.ogilvy.it/ca/en/xp/add-your-golden-touch Critical No bounty
  • https://ferrerorocher-aygt.ogilvy.it/de/de/xp/vergolde-dein-weihnachten Critical No bounty
  • https://ferrerorocher-aygt.ogilvy.it/jp/ja/xp/add-your-golden-touch Critical No bounty
  • https://ferrerorocher-aygt.ogilvy.it/za/en/xp/add-your-golden-touch Critical No bounty
  • https://ferrero-rocher.co.il Critical No bounty
  • https://ferrerorochergoldengift.com/roadshow/login.html Critical No bounty
  • https://ferrerorochergoldentouch.com/us/en/xp/add-your-golden-touch/berlin-beta Critical No bounty
  • https://ferrerorocherpromo.ro/ro/ro/xp/cadoul-mai-presus-de-cuvinte Critical No bounty
  • https://ferrerorocherpromo.ro/ro/ro/xp/clipa-de-aur Critical No bounty
  • https://ferrerorocherpromo.ro/ro/ro/xp/lumineaza-clipele-speciale-inscriere Critical No bounty
  • https://ferrerorocher.ro/ro/ro/xp/lumineaza-clipele-speciale-inscriere Critical No bounty
  • https://ferrero.somese.lv/lv/edit Critical No bounty
  • https://ferrero.somese.lv/lv/lv/xp/pavasaris Critical No bounty
  • https://findyourmatch25.strategie.agency/be/fr/xp/findyourmatch Critical No bounty
  • https://fulfilborsoni.ferreropromo.it Critical No bounty
  • https://gewinnspiel.mein-ferrero.de/jutebeutel Critical No bounty
  • https://gewinnspiel.mein-ferrero.de/loyalty-gewinnspiel Critical No bounty
  • https://gewinnspiel.mein-ferrero.de/nutella-donut Critical No bounty
  • https://gewinnspiel.mein-ferrero.de/rocher-winterhighlights Critical No bounty
  • https://giotto.couponinghouse.de/xp/potluck Critical No bounty
  • https://goldenexperience.ferrero-campaigns.com/bg/bg/xp/goldenexperience Critical No bounty
  • https://jarpecarpromo.theofferclub.in/administrator/auth Critical No bounty
  • https://jarpecarpromo.tictac.com Critical No bounty
  • https://jd2025admindemo.ferrero.com.cn/default/login.html Critical No bounty
  • https://keeblerspookiesweeps.com Critical No bounty
  • https://keeblerspookiesweeps.com/berlin-beta Critical No bounty
  • https://kids.kinder.ro/ro/ro/xp/lets-story Critical No bounty
  • https://kinderamc.gypserver.com/h5v3/?openid=889900 Critical No bounty
  • https://kinderbuenogamedaysweeps.com/us/en/xp/game-day-sweeps/berlin-beta Critical No bounty
  • https://kinderchocolateoffer.com/us/en/xp/kinder-chocolate-offer/berlin-beta Critical No bounty
  • https://kinderchocolate.pl/pl/pl/xp/kinder-chocolate Critical No bounty
  • https://kindercolorbots.h2h.tech/pl/pl/xp/kindercolorbots Critical No bounty
  • https://kinderjoy.tlccloud.net Critical No bounty
  • https://kinderletsstory.uglobal.com.cn Critical No bounty
  • https://kinder.somese.lv/lv/edit Critical No bounty
  • https://kinder.somese.lv/lv/lv/xp/kidsday2024 Critical No bounty
  • https://kinder.somese.lv/lv/lv/xp/kinder-surprise-2024 Critical No bounty
  • https://kinder.somese.lv/lv/lv/xp/kindertime2024 Critical No bounty
  • https://kinderviaggi2025esercenti.ferreroprofessional.it Critical No bounty
  • https://kinder.whitecat.ro/ro/ro/xp/country-break Critical No bounty
  • https://leto-zavtrak.ru Critical No bounty
  • https://live.nutella.com/pl/pl/xp/nutelladodajeusmiechu2026 Critical No bounty
  • https://multi.somese.lv/raffaello/2024/lv Critical No bounty
  • https://ncp2026.ferrero-campaigns.com/bg/bg/xp/refinedtaste Critical No bounty
  • https://nutella.com/ro/ro/xp/craciunul-cu-nutella Critical No bounty
  • https://nutella.ferrerobulgariapromo.com/bg/bg/xp/nutellaandbread Critical No bounty
  • https://nutella.ferrerobulgariapromo.com/bg/bg/xp/nutellaandbread/admin Critical No bounty
  • https://nutella.ferrerobulgariapromo.com/bg/bg/xp/xmas Critical No bounty
  • https://nutella.ferrerobulgariapromo.com/bg/bg/xp/xmas/admin Critical No bounty
  • https://nutellaholidays.com/us/en/xp/holidays/berlin-beta Critical No bounty
  • https://nutellapancake2026.nutella.com/admin_na8qnm4hfa/login Critical No bounty
  • https://nutellapancake2026.nutella.com/pl/pl/xp/pancake Critical No bounty
  • https://nutellapromo.es/es/es/xp/nutella-pan/dashboard Critical No bounty
  • https://nutella.ru Critical No bounty
  • https://nutella.somese.lv/bc/lv/edit Critical No bounty
  • https://nutella.somese.lv/bc/lv/xp/60years Critical No bounty
  • https://nutellastacksforgivingback.com/us/en/xp/stacksforgivingback/berlin-beta Critical No bounty
  • https://nutellasummer.nutella.com/pl/pl/xp/nutelladziendobry2026 Critical No bounty
  • https://nutellasuperfan.com/us/en/xp/world-nutella-day/berlin-beta Critical No bounty
  • https://odswiezlatomuzyka.com Critical No bounty
  • https://pasqua2026.pocketcoffee.it Critical No bounty
  • https://ppd.clubferreropro.com Critical No bounty
  • https://ppd.clubferreropro.com/admin Critical No bounty
  • https://preprod.clubferreropro.com Critical No bounty
  • https://preprod.nutella.ai/admin/#/ Critical No bounty
  • https://prod.kinderpack.be/fr Critical No bounty
  • https://prod.tennistrophy.com Critical No bounty
  • https://prod.tennistrophy.it Critical No bounty
  • https://promocionesraffaello.com Critical No bounty
  • https://promo.nutella.ro/ro/ro/xp/buna-dimineata Critical No bounty
  • https://promo.nutella.ro/ro/ro/xp/craciunul-cu-nutella Critical No bounty
  • https://promo.nutella.ro/ro/ro/xp/dimineata-incepe-cu-nutella Critical No bounty
  • https://promo.nutella.ro/ro/ro/xp/dimineata-mai-buna Critical No bounty
  • https://promo.nutella.ro/ro/ro/xp/nutella-loves-bread Critical No bounty
  • https://quality-aldi-sommerfreude-de-2025.ipaasferrero.com/?appkey=aldinordapp Critical No bounty
  • https://quality-chocofresh-gratistesten-de-2025.ipaasferrero.com/de/de/xp/kinder-chocofresh-gratistesten Critical No bounty
  • https://quality-dinos-de-2025.ipaasferrero.com/de/de/xp/dinos Critical No bounty
  • https://quality-doppelte-freude-rewe-de-2025.ipaasferrero.com Critical No bounty
  • https://quality-eatnatural-promo-2025-de-2025.ipaasferrero.com/de/de/xp/eatnatural-promo Critical No bounty
  • https://quality-edeka-herzen-de-2026.ipaasferrero.com Critical No bounty
  • https://quality-edeka-herzenswuensche-de-2025.ipaasferrero.com Critical No bounty
  • https://quality-estathefornopizza26.estathe.it Critical No bounty
  • https://quality-ferrerocollection-com-2026.ipaasferrero.com/us Critical No bounty
  • https://quality-ferrero-feinschlecker-de-2026.ipaasferrero.com/xp/feinschlecker Critical No bounty
  • https://quality-ferrero-genussmomente-de-2025.ipaasferrero.com Critical No bounty
  • https://quality-ferrero-globus-gewinnspiel-de-2025.ipaasferrero.com Critical No bounty
  • https://quality-ferrero-globus-gewinnspiel-de-2026.ipaasferrero.com Critical No bounty
  • https://quality-ferrero-knusperliebe-de-2025.ipaasferrero.com Critical No bounty
  • https://quality-ferrero-pralinen-de-2025.ipaasferrero.com Critical No bounty
  • https://quality-ferrero-snacknstyle-de-2025.ipaasferrero.com Critical No bounty
  • https://quality-ferrero-superkuesschen-de-2025.ipaasferrero.com/xp/superkuesschen Critical No bounty
  • https://quality-gemeinsam-jubeln-rewe-de-2026.ipaasferrero.com Critical No bounty
  • https://quality-golden-ticket-de-2026.ipaasferrero.com/de/de/xp/golden-ticket Critical No bounty
  • https://quality-golden-ticket-uk-2026.ipaasferrero.com/uk/uk/xp/golden-ticket Critical No bounty
  • https://quality-golden-ticket-us-2026.ipaasferrero.com/us/en/xp/golden-ticket Critical No bounty
  • https://quality-goodmorning26-nl-2026.ipaasferrero.com/nl/nl/xp/goodmorning26 Critical No bounty
  • https://quality-goodmorning26-nl-2026.ipaasferrero.com/nl/nl/xp/goodmorning26/user/login Critical No bounty
  • https://quality-kinderriegel-love-de-2025.ipaasferrero.com/de/de/xp/kinderriegel-love Critical No bounty
  • https://quality-kjoy-strangerthings-de-2025.ipaasferrero.com/de/de/xp/kjoy-strangerthings Critical No bounty
  • https://quality-kreativ-mit-ferrero-de-2024.ipaasferrero.com Critical No bounty
  • https://quality-milch-schnitte-soft-wie-eine-umarmung-de-2025.ipaasferrero.com/de/de/xp/milch-schnitte-soft-wie-eine-umarmung Critical No bounty
  • https://quality-momente-2025-de-2025.ipaasferrero.com/xp/momente Critical No bounty
  • https://quality-moncheri-de-2025-2025.ipaasferrero.com Critical No bounty
  • https://quality-netto-rubbellos-2025-de-2025.ipaasferrero.com Critical No bounty
  • https://quality-nutella-academy-de-2026.ipaasferrero.com/de/de/xp/nutella-academy Critical No bounty
  • https://quality-nutella-minis-de-2025.ipaasferrero.com/de/de/xp/nutella-minis Critical No bounty
  • https://quality-party-de-2025.ipaasferrero.com/de/de/xp/party Critical No bounty
  • https://quality-pasqua2026-be-pocketcoffee-it-2025.ipaasferrero.com/admin Critical No bounty
  • https://quality-pasqua2026.pocketcoffee.it Critical No bounty
  • https://quality-playmobil-de-2025.ipaasferrero.com/de/de/xp/playmobil Critical No bounty
  • https://quality.prod.kinder.com/it/it/xp/kindermomentinsieme2025 Critical No bounty
  • https://quality.prod.nutella.com/it/it/xp/nutellatagliere2025 Critical No bounty
  • https://quality-sampling-gewinnspiel-de-2025.ipaasferrero.com/xp/sampling-gewinnspiel Critical No bounty
  • https://quality-strangerthings-de-2025.ipaasferrero.com/de/de/xp/strangerthings Critical No bounty
  • https://quality-ticket-d-or-fr-2026.ipaasferrero.com/fr/fr/xp/ticket-d-or Critical No bounty
  • https://quality-vinciwonka2026-it-2026.ipaasferrero.com/it/it/xp/vinciwonka2026 Critical No bounty
  • https://quality-wonka-us-2026.ipaasferrero.com/uk/en Critical No bounty
  • https://quality-xmas-com-2026.ipaasferrero.com/uk/en/xp/nutella-christmas Critical No bounty
  • https://raffaello.bg Critical No bounty
  • https://raffaello.com/ro/ro/xp/mai-presus-de-cuvinte Critical No bounty
  • https://raffaello.lv/loterija_tmp Critical No bounty
  • https://recipe-assistant.nutella.com/us/en/xp/recipe-assistant Critical No bounty
  • https://scanandwinpromo.theofferclub.in Critical No bounty
  • https://scanandwinpromo.theofferclub.in/administrator/auth Critical No bounty
  • https://scanandwinpromo.tictac.com Critical No bounty
  • https://spookiefts.com Critical No bounty
  • https://srv-plesk16.ps.kz:8443/smb/file-manager/list?subscriptionid=870 Critical No bounty
  • And 186 more on HackerOne.

Wildcard domains 28

  • *.babyruth.com Critical No bounty
  • *.butterfinger.com Critical No bounty
  • *.crunchbar.com Critical No bounty
  • *.duplo.de Critical No bounty
  • *.eatnatural.com Critical No bounty
  • *.estathe.it Critical No bounty
  • *.famousamos.com Critical No bounty
  • *.fanniemay.com Critical No bounty
  • *.ferrero.com Critical No bounty
  • *.ferrero-kuesschen.de Critical No bounty
  • *.ferreropromo.it Critical No bounty
  • *.ferrerorocher.com Critical No bounty
  • *.fiestaferrero.it Critical No bounty
  • *.fulfilnutrition.com Critical No bounty
  • *.giotto.de Critical No bounty
  • *.hanuta.de Critical No bounty
  • *.keebler.com Critical No bounty
  • *.kinder.com Critical No bounty
  • *.littlebrowniebakers.com Critical No bounty
  • *.moncheri.it Critical No bounty
  • *.motherscookies.com Critical No bounty
  • *.murraysugarfree.com Critical No bounty
  • *.nutella.com Critical No bounty
  • *.pocketcoffee.it Critical No bounty
  • *.raffaello.com Critical No bounty
  • *.thorntons.com Critical No bounty
  • *.tictac.com Critical No bounty
  • *.yogurette.de Critical No bounty

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Ferrero (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • DO NOT alter compromised accounts by creating, deleting or modifying any data
  • DO NOT use compromised accounts to search for post-auth vulnerabilities
  • DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC
  • In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
  • In case of sensitive information leak, DO NOT extract/copy every document or data that is exposed and limit yourself to describe and list what is exposed.
  • You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about requests per second).
  • You must not leak, manipulate, or destroy any user data.
  • Other techniques and procedures for lateral movement, post-exploitation or establishing persistence through back-doors are completely forbidden.
  • Customer or employee account compromise through bruteforce, dictionary or password guessing attacks are forbidden.
  • Phishing, spear phishing or any type of social engineering tests, against either employees or customers are prohibited.

Not accepted

  • Stolen secrets, credentials or information gathered from a third-party asset that we have no control over
  • Tabnabbing
  • Session expiration policies (no automatic logout, invalidation after a certain time or after a password change)
  • Content/Text/HTML/CSV injections and Mixed Content warnings
  • Clickjacking/UI redressing
  • Denial of Service (DoS) attacks
  • Known CVEs without working PoC and outdated libraries without a demonstrated security impact
  • Reports from automated web vulnerability scanners that have not been manually validated
  • Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC)
  • Open ports without real security impact
  • Physical or Social engineering of staff or contractors and/or any issues that require physical access to a victim’s computer/device
  • Presence of autocomplete attribute on web forms
  • Vulnerabilities affecting outdated browsers or platforms
  • Any hypothetical flaw or best practices without exploitable PoC
  • Unexploitable vulnerabilities (ex: Self XSS, Blind SSRF without direct impact (e.g. DNS pingback), XSS or Open Redirect in HTTP Host Header)
  • Reports with attack scenarios requiring MITM or physical access to victim's device
  • Unauthenticated / Logout / Login and other low-severity Cross-Site Request Forgery (CSRF)
  • Subdomain takeover without a full working PoC
  • Lack of rate-limiting, brute-forcing or captcha issues and password requirements policies (length / complexity / reuse)
  • Ability to spam users (email / SMS / direct messages flooding)

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

  1. Scope +

    Added to scope: ferrero.integrityline.app

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://www.wonka.com/us/en/xp/golden-ticket/

  2. Scope added

    https://quality-golden-ticket-us-2026.ipaasferrero.com/us/en/xp/golden-ticket/

  3. Scope added

    https://www.kinder.com/in/en/xp/ksbcavengers

  4. Scope added

    https://cms-ksbcavengers-in-2026.ipaasferrero.com/in/en/xp/ksbcavengers/user/login

  5. Scope added

    https://cms-pingui-win-uk-2026.ipaasferrero.com/uk/en/xp/pingui-win/user/

  6. Scope added

    https://cmsquality-golden-ticket-us-2026.ipaasferrero.com/us/en/xp/golden-ticket/user/login/

  7. Scope added

    https://cmsquality-vinciwonka2026-it-2026.ipaasferrero.com/it/it/xp/vinciwonka2026/user/login

  8. Scope added

    https://eventi.ferrero.it

  9. Scope added

    https://www.formulaire-jeu-concours.ferrero.fr/

  10. Scope added

    https://www.pp-formulaire-jeu-concours.ferrero.fr/

  11. Scope added

    https://quality-ticket-d-or-fr-2026.ipaasferrero.com/fr/fr/xp/ticket-d-or/

  12. Scope added

    https://www.nutella.com/de/de/xp/brot-entdecken

  13. Scope added

    https://cmsquality-ticket-d-or-fr-2026.ipaasferrero.com/fr/fr/xp/ticket-d-or/user/login

  14. Scope added

    https://cmsquality-xmas-com-2026.ipaasferrero.com/uk/en/xp/nutella-christmas/

  15. Scope added

    https://quality-xmas-com-2026.ipaasferrero.com/uk/en/xp/nutella-christmas/

  16. Scope added

    https://www.ferrerorocher.com/us/en/xp/make-it-gold

  17. Scope added

    https://quality-nutella-academy-de-2026.ipaasferrero.com/de/de/xp/nutella-academy/

  18. Scope added

    https://quality-vinciwonka2026-it-2026.ipaasferrero.com/it/it/xp/vinciwonka2026/

  19. Scope added

    https://tic-tac-two-preview.tictac.com

  20. Scope added

    https://cmsquality-wonka-us-2026.ipaasferrero.com/uk/user

  21. Scope added

    https://tic-tac-two.tictac.com/au/en/xp/tic-tac-two

  22. Scope added

    https://quality-golden-ticket-de-2026.ipaasferrero.com/de/de/xp/golden-ticket/

  23. Scope added

    http://quality-ksb-onepiecenetflix-de-2026.ipaasferrero.com/de/de/xp/ksb-onepiecenetflix

  24. Scope added

    https://baltic.kinder.com/lv/lv/xp/bueno/

  25. Scope added

    https://cmsquality-golden-ticket-de-2026.ipaasferrero.com/de/de/xp/golden-ticket/user/login/

  26. Scope added

    https://quality-wonka-us-2026.ipaasferrero.com/uk/en/

  27. Scope added

    https://prod.kinderpack.be/fr

  28. Scope added

    https://ncp2026.ferrero-campaigns.com/bg/bg/xp/refinedtaste/

  29. Scope added

    https://beta.nutellakochapieczywo.nutella.com

  30. Scope added

    https://nutella.ferrerobulgariapromo.com/bg/bg/xp/nutellaandbread/admin

  31. Scope added

    https://gewinnspiel.mein-ferrero.de/jutebeutel

  32. Scope added

    https://baltic.nutella.com/bc/lv/xp/maize/

  33. Scope added

    https://estathebacktowork26.estathe.it

  34. Scope added

    https://www.pocketcoffee.de/

  35. Scope added

    https://stage.spookiefts.com/

  36. Scope added

    https://keeblerspookiesweeps.com/berlin-beta/

  37. Scope added

    https://kinderchocolate.pl/pl/pl/xp/kinder-chocolate/

  38. Scope added

    https://2627.quellidellacolazione.it/

  39. Scope added

    https://kinderamc.gypserver.com/h5v3/?openid=889900

  40. Scope added

    https://kindercolorbots.h2h.tech/pl/pl/xp/kindercolorbots/

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Scope Exclusions

  • All domains or subdomains not explicitly listed in the Scope of the program

Overview

Ferrero International S.A. is an Italian multinational manufacturer of branded chocolate and confectionery products, and the second biggest chocolate producer and confectionery company in the world. It was founded in 1946 in Alba, Piedmont, Italy, by Pietro Ferrero, a confectioner and small-time pastry maker who laid the groundwork for Nutella and added hazelnut to save money on chocolate, taking the idea from gianduia, a sweet chocolate spread containing about 30% hazelnut paste, invented in Turin during Napoleon's regency (1796–1814). The Ferrero Group has a strong global presence and Ferrero products are present and sold, directly or through authorised retailers, in more than 170 countries belonging to the entire international community.

We believe that no technology is perfect and that working with skilled security researchers is crucial in identifying weaknesses in our technology.

The Purpose of the Vulnerability Disclosure Policy (VDP) is to give security researchers clear guidelines for conducting vulnerability research, discovery, and reporting on Ferrero's systems. Ferrero looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.

Program Rules

Recognition

Once a report is resolved and closed, the researcher will receive a +7 count on their public profile under “Thanks Received” and be listed on Ferrero’s HackerOne webpage under “Hackers Thanked.”

Ferrero will determine, in its sole discretion, whether recognition will be provided, and Ferrero will only recognize the first researcher to have discovered a specific, and previously unreported, vulnerability. Ferrero reserves the right to withhold recognition for researchers who have violated this policy in the past.

The report submitted will be reviewed by a team of security experts. We are happy to thank everyone who submits valid reports which help us improve our security posture.

Rules Of Engagement

While researching for Cyber Security related issues the following rules of engagement must be followed:

  • DO NOT alter compromised accounts by creating, deleting or modifying any data
  • DO NOT use compromised accounts to search for post-auth vulnerabilities
  • DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible.
  • In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
  • In case of sensitive information leak, DO NOT extract/copy every document or data that is exposed and limit yourself to describe and list what is exposed.
  • You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about requests per second).
  • You must not leak, manipulate, or destroy any user data.
  • Avoid further unnecessary exploitation when you've found a critical vulnerability, stop to what is strictly required to produce a functional PoC, for instance:
    • For RCE PoC, it would be sufficient to perform whoami ; uname commands, no need to compromise the entire OS.
    • For SQLi, it would be sufficient to print the DB banner or show the DB name, username, table names, but no need to dump the entire DB.
  • Other techniques and procedures for lateral movement, post-exploitation or establishing persistence through back-doors are completely forbidden.
  • Customer or employee account compromise through bruteforce, dictionary or password guessing attacks are forbidden. However, default system/aplication passwords can be reported if present.
  • Phishing, spear phishing or any type of social engineering tests, against either employees or customers are prohibited.
  • You must not be a former or current employee of Ferrero or one of its contractor.
  • You must not have compromised the privacy of our users
  • Only interact with test accounts you own

Unqualifying Issues

The following issues are outside the scope of our vulnerability disclosure program:

  • Stolen secrets, credentials or information gathered from a third-party asset that we have no control over
  • Tabnabbing
  • Missing cookie flags, security-related HTTP headers and Expired certificate or best practices and other related issues for TLS/SSL certificates which do not lead directly to a vulnerability
  • Session expiration policies (no automatic logout, invalidation after a certain time or after a password change)
  • Disclosure of information without direct security impact (e.g. stack traces, secrets, credentials, path disclosure, software versions, IP disclosure, 3rd party secrets)
  • Content/Text/HTML/CSV injections and Mixed Content warnings
  • Clickjacking/UI redressing
  • Denial of Service (DoS) attacks
  • Known CVEs without working PoC and outdated libraries without a demonstrated security impact
  • Reports from automated web vulnerability scanners that have not been manually validated
  • Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC)
  • Open ports without real security impact
  • Physical or Social engineering of staff or contractors and/or any issues that require physical access to a victim’s computer/device
  • Presence of autocomplete attribute on web forms
  • Vulnerabilities affecting outdated browsers or platforms
  • Any hypothetical flaw or best practices without exploitable PoC
  • Unexploitable vulnerabilities (ex: Self XSS, Blind SSRF without direct impact (e.g. DNS pingback), XSS or Open Redirect in HTTP Host Header)
  • Reports with attack scenarios requiring MITM or physical access to victim's device
  • Unauthenticated / Logout / Login and other low-severity Cross-Site Request Forgery (CSRF)
  • Subdomain takeover without a full working PoC
  • Lack of rate-limiting, brute-forcing or captcha issues and password requirements policies (length / complexity / reuse)
  • Ability to spam users (email / SMS / direct messages flooding)

Testing Instructions

Hacker Account Creation

We require to use your HackerOne email alias [username]@wearehackerone.com to create your test accounts on the in-scope assets.

User agent

Please append to your user-agent header the following value: -VDP-ferrero-international-s.a-[H1 username]

Disclosure Policy

You must not discuss any vulnerabilities (even resolved ones) outside of the program without express and explicit consent from the organization.

Legal Notice:

If we conclude, in our sole discretion, that you have complied with the requirements above when reporting a security vulnerability, Ferrero will not pursue claims against you or initiate a law enforcement investigation in response to your report:

  • You do not cause harm to Ferrero or our customers;
  • You make a good faith effort to avoid compromising the privacy of our customers or employees, or disrupting the operation of our products, services or IT infrastructure;
  • You do not violate any law;
  • Once you have confirmed a vulnerability, you report it in a timely manner and do not exploit it further;
  • To the extent that you have accessed non-public Ferrero information in the course of your research, you do not maintain copies of any such information or share any such information with any third party;
  • You do not publicly disclose or share the vulnerability details without the written permission of Ferrero. Violation of these requirements may result in permanent disqualification from the program.

Any activity determined to involve the intentional compromise of the privacy of our customers or employees or the intentional disruption of the operation of our products, services or IT infrastructure will result in permanent disqualification from the program.

We may collect information that could reasonably be used to identify you (e.g., IP address). Ferrero uses this information to evaluate a reported vulnerability and protect Ferrero products, services or information technology infrastructure.