Finnair Vulnerability Disclosure
By Finnair Vulnerability disclosure program on HackerOne finnair.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 41
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 2 days
| First Response | 2 days |
- Safe harbor
-
Partial
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
41 assets you may test, 2 excluded.
Web 16
- aurinkomatkat.fi Critical No bounty
- auth.finnair.com Critical No bounty
- cargo.finnair.com Critical No bounty
- cms.finnair.com Critical No bounty
- customercare.finnair.com Critical No bounty
- easy.finnair.com Critical No bounty
- fast.finnair.com Critical No bounty
- finnair.com Critical No bounty
- finnairflightacademy.com Critical No bounty
- finnairshop.com Critical No bounty
- partners.finnair.fi Critical No bounty
- pay.finnair.com Critical No bounty
- paywithpoints.finnair.com Critical No bounty
- preauth.finnair.com Critical No bounty
- privacy.finnair.com Critical No bounty
- www.finnair.com Critical No bounty
APIs 10
- https://api-dev.finnair.com/d/* Critical No bounty
- https://api.finnair.com/c/* Critical No bounty
- https://api.finnair.com/d/customer/* Critical No bounty
- https://api.finnair.com/d/customer-care-api/* Critical No bounty
- https://api.finnair.com/d/fcom/* Critical No bounty
- https://api.finnair.com/d/loyalty-service/ * Critical No bounty
- https://api.finnair.com/d/mobileapp/* Critical No bounty
- https://api.finnair.com/d/mobileapp-services/* Critical No bounty
- https://api.finnair.com/d/payments/* Critical No bounty
- https://api-preprod.finnair.com/d/* Critical No bounty
Wildcard domains 10
- *.aurinkomatkat.fi Critical No bounty
- *.cloud.finnair.com Critical No bounty
- *.dev.app.finnair.com Critical No bounty
- *-dev.finnair.com Critical No bounty
- *.finnair.com Critical No bounty
- *.finnairshop.com Critical No bounty
- *.ifec-ground.com Critical No bounty
- *.preprod.app.finnair.com Critical No bounty
- *-preprod.finnair.com Critical No bounty
- *.prod.app.finnair.com Critical No bounty
Android apps 1
- com.finnair Critical No bounty
Networks 1
- 157.200.0.0/16 Critical No bounty
iOS apps 1
- 933867978 Critical No bounty
Products and areas 2
- Finnair Assets Critical No bounty
- GitHub (FinnairOyj) Critical No bounty
Out of scope (2)
- 3rd-party assets
- @finnairoyj (npmjs)
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Finnair Vulnerability Disclosure (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please provide detailed reports with reproducible steps.
-
Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with explicit permission of the account holder.
-
Keep automated testing to the minimum needed to demonstrate an issue and below 5 requests per second per host.
-
Do not run unattended scanners against production.
-
Include the `X-HackerOne-Research: [H1 username]` header in every request.
-
Do not attempt to login with the leaked username/password combination.
-
A person must verify and reproduce every finding before it is reported.
Not accepted
-
Clickjacking on pages with no sensitive actions
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Missing best practices in SSL/TLS configuration.
-
Any activity that could lead to the disruption of our service (DoS).
-
Rate limiting or bruteforce issues on non-authentication endpoints
-
Missing best practices in Content Security Policy.
-
Missing HttpOnly or Secure flags on cookies
-
Configuration of or missing security headers.
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
-
Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
-
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
-
Tabnabbing
-
Issues that require unlikely user interaction
-
Improper logout functionality and improper session timeout.
-
CORS misconfiguration without an exploitation scenario
-
Broken link hijacking
-
Lack of jailbreak detection in mobile apps.
-
Lack of SSL Pinning
-
Consumer/customer credentials from third-party breach databases or info-stealer logs.
-
Employee credentials from decommissioned systems or inactive accounts.
-
Bulk credential dumps without validation of current validity.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Rules updated
Removed: “Please note, that following assets are out of the program scope:”
-
Scope added
https://*.ifec-ground.com
-
Scope added
3rd-party assets (out of scope)
-
Scope added
https://api.finnair.com/c/*
-
Scope added
@finnairoyj (npmjs) (out of scope)
-
Scope added
GitHub (FinnairOyj)
-
Rules updated
Added: “A vulnerability that is present in several environments counts as one report.”
-
Scope added
finnair.com
-
Scope added
finnairshop.com
-
Scope added
https://*-dev.finnair.com/
-
Scope added
https://*-preprod.finnair.com/
-
Scope added
https://*.finnair.com/
-
Scope added
https://api-dev.finnair.com/d/*
-
Scope added
https://api.finnair.com/d/loyalty-service/ *
-
Scope added
pay.finnair.com
-
Scope added
paywithpoints.finnair.com
-
Scope added
preauth.finnair.com
-
Scope added
www.finnair.com
-
Scope added
https://api-preprod.finnair.com/d/*
-
Scope added
*.cloud.finnair.com
-
Scope added
*.dev.app.finnair.com
-
Scope added
*.finnairshop.com
-
Scope added
*.preprod.app.finnair.com
-
Scope added
*.prod.app.finnair.com
-
Scope added
157.200.0.0/16
-
Scope added
*.aurinkomatkat.fi
-
Scope added
933867978
-
Scope added
aurinkomatkat.fi
-
Scope added
cargo.finnair.com
-
Scope added
cms.finnair.com
-
Scope added
com.finnair
-
Scope added
customercare.finnair.com
-
Scope added
easy.finnair.com
-
Scope added
fast.finnair.com
-
Scope added
finnairflightacademy.com
-
Scope added
partners.finnair.fi
-
Scope added
privacy.finnair.com
-
Scope added
Finnair Assets
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Finnair looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
Response Targets
Finnair will make a best effort to meet the following response targets for hackers participating in our program:
| Type of Response | Target in business days |
|---|---|
| First Response | 2 days |
| Time to Triage | 2 days |
| Time to Resolution | depends on severity and complexity |
We’ll try to keep you informed about our progress throughout the process.
Disclosure Policy
- Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's disclosure guidelines.
Program Rules
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
- Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
- A vulnerability that is present in several environments counts as one report.
- Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
- Reports that demonstrate different vulnerabilities, each with its own demonstrated impact, are assessed separately even if they share an access path.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
- Only interact with accounts you own or with explicit permission of the account holder.
- Please use your hacker email alias when testing ([email protected]) and add headers to requests (such as
X-HackerOne-Research: [H1 username]) - Keep automated testing to the minimum needed to demonstrate an issue and below 5 requests per second per host. Do not run unattended scanners against production. Activity that degrades the service will not be triaged, and testing above these limits may affect whether a report is accepted.
- In most cases, we determine severity using CVSS and the real impact of the vulnerability. All decisions on severity are at our discretion.
Instructions for agentic testing
These instructions apply to AI agents, LLM-based or any automation tools, in addition to the rest of this policy and the program scope. You are responsible for what your tools do.
- Test only assets listed as in scope.
- Send the
X-HackerOne-Research: [H1 username]header on every request. - Keep requests to the minimum needed and below 5 requests per second per host.
- Do not run unattended agents against production.
- Stop on repeated 429 responses, bot protection challenges, repeated errors or signs of degraded service.
- Use only your own accounts and data. If you see real customer data, stop and report it to the program.
- Use the information here as your primary reference, rather than relying on AI-generated suggestions.
- A person must verify and reproduce every finding before it is reported.
- All submissions must be original, manually verified, and include clear proof of impact.
- Please ensure reports are accurate, relevant, and meet program standards before submission.
Testing Environments
- Prefer pre-production or development environments when available. Pre-production closely matches production, but not always exactly.
- Our DNS naming follows these patterns, where the environment is dev, preprod or prod:
<service>.<env>.app.finnair.com, for exampleexample.preprod.app.finnair.com<service>.finnair.comor<service>-<env>.finnair.com, for exampleexample-preprod.finnair.comapi.finnair.comorapi-<env>.finnair.com, for exampleapi-preprod.finnair.com
- We still accept and triage findings that affect only development or pre-production environments.
Session Layer: HTTP Headers
Researchers should add headers to requests such as:
X-HackerOne-Research: [H1 username]- Include the
X-HackerOne-Research: [H1 username]header in every request. Where possible, put your H1 username in test data you create, such as names and free-text fields. Testing without the header may affect how we handle your report.
Out of scope vulnerabilities
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
- Clickjacking on pages with no sensitive actions
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
- Attacks requiring MITM or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept.
- Comma Separated Values (CSV) injection without demonstrating a vulnerability.
- Missing best practices in SSL/TLS configuration.
- Any activity that could lead to the disruption of our service (DoS).
- Rate limiting or bruteforce issues on non-authentication endpoints
- Missing best practices in Content Security Policy.
- Missing HttpOnly or Secure flags on cookies
- Configuration of or missing security headers.
- Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
- Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
- Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
- Tabnabbing
- Issues that require unlikely user interaction
- Improper logout functionality and improper session timeout.
- CORS misconfiguration without an exploitation scenario
- Broken link hijacking
- Lack of jailbreak detection in mobile apps.
- Lack of SSL Pinning
Specifications
Rate limiting
- We define authentication endpoints as those that verify a user's identity, whether by password, code or other details only the user is expected to know.
- Reports demonstrating missing rate limiting on authentication endpoints are only accepted when demonstrated using own account and test data, staying within our testing limits on in-scope assets.
- Rate limiting and other bruteforce related findings are capped at Medium severity.
Leaked Credentials
General guidelines
- Do not attempt to login with the leaked username/password combination.
- Try to assess the validity based on the domain and the date of the actual leak (not the date of indexing).
- If you are unsure about the validity, create a report for the vulnerability disclosure team to verify the validity of the credentials.
Out-of-scope
- Consumer/customer credentials from third-party breach databases or info-stealer logs.
- Employee credentials from decommissioned systems or inactive accounts.
- Bulk credential dumps without validation of current validity.
In-scope
- Valid, current employee credentials from active Finnair systems that pose immediate security risk.
--
Thank you for helping keep Finnair and our users safe!