Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Here Technologies

Bug bounty on Intigriti here.com

Paused Full safe harbor
Go to program
Top reward
€2,000
Top severity paid
Critical
Assets in scope
23
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to €2,000
for critical bugs.
Report on Intigriti
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 2 days
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What Intigriti lists as the payout for each severity.

Severity Reward
Critical €2,000 from €1,000
High €1,000
Medium €250
Low €50
Response
Within 2 days 2 business days for every exceptional and critical severity issue you report
Safe harbor
Full We respect the safe harbor clause that you can find below

Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

23 assets you may test.

Web 10

  • account.api.here.com
  • account.here.com
  • listing.here.com
  • mapcreator.here.com
  • mobilitygraph.hereapi.com
  • registry.service.api.platform.here.com
  • search.hereapi.com
  • transit.hereapi.com
  • vector.hereapi.com
  • xyz.api.here.com

Wildcard domains 8

  • *.data.api.platform.here.com
  • *.hereapi.com
  • *.here.com
  • *.metrics.platform.here.com
  • *.platform.here.com
  • *.router.hereapi.com
  • *.scbe.api.here.com
  • *.subp-router.hereapi.com

Android apps 1

  • HERE WeGo Android

iOS apps 1

  • HERE WeGo iOS

Products and areas 3

  • All other related services owned by HERE
  • Leaked/Compromised Employee Credentials
  • Leaked Service Credentials

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Here Technologies (via Intigriti)'s policy. "We" in these lines means the program, not this site.

While testing

  • All reports should be written in English
  • Provide detailed but to the point reproduction steps
  • Include a clear attack scenario. How will this affect us exactly?
  • Please do *not* discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo)
  • Please do *not* use automatic scanners (be creative and do it yourself!). We cannot accept any submissions found by using automatic scanners.
  • More than 10 requests per second
  • You can self-register on the application but please don’t forget to use your @intigriti.me address.

Not accepted

  • Duplicate reports
  • Issues requiring unrealistic or overly complex user interaction
  • Reports without proof of concept
  • Spam, social engineering, or physical intrusion
  • DoS / DDoS / brute-force attacks
  • Vulnerabilities affecting unsupported or end-of-life software
  • Recently disclosed zero-day vulnerabilities (within 14 days of patch release)
  • SSL/TLS misconfigurations without server-side impact
  • Missing security headers or cookie flags (Secure, HttpOnly, SameSite)
  • Lack or bypass of rate limiting
  • Password policy issues (complexity, expiration, reuse)
  • Self-XSS without impact on other users
  • Clickjacking without realistic exploitation
  • CSV injection
  • Username/email enumeration
  • API key disclosure without proven impact
  • CORS misconfiguration on non-sensitive endpoints
  • CSRF with low or no impact
  • Blind SSRF without proven impact
  • Subdomain takeover without actual takeover
  • Email bombing
  • Homograph attacks
  • Issues related to email spoofing (SPF, DKIM, DMARC)
  • Absence of certificate pinning

Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 49 minutes ago.

  1. Paused

    Paused. Not accepting reports right now.

  2. Back

    Open for reports again.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Status

    Program status changed

  2. Status

    Program status changed

  3. Status

    Program status changed

  4. Status

    Program status changed

  5. Status

    Program status changed

  6. Status

    Program status changed

  7. Status

    Program status changed

  8. Status

    Program status changed

  9. Status

    Program status changed

  10. Status

    Program status changed

  11. Status

    Program status changed

  12. Status

    Program status changed

  13. Status

    Program status changed

  14. Status

    Program status changed

  15. Status

    Program status changed

  16. Status

    Program status changed

  17. Status

    Program status changed

  18. Status

    Program status changed

  19. Status

    Program status changed

  20. Status

    Program status changed

  21. Status

    Program status changed

  22. Status

    Program status changed

  23. Status

    Program status changed

  24. Status

    Program status changed

  25. Status

    Program status changed

  26. Status

    Program status changed

  27. Status

    Program status changed

  28. Status

    Program status changed

  29. Status

    Program status changed

  30. Status

    Program status changed

  31. Status

    Program status changed

  32. Status

    Program status changed

  33. Status

    Program status changed

  34. Status

    Program status changed

  35. Status

    Program status changed

  36. Status

    Program status changed

  37. Status

    Program status changed

  38. Status

    Program status changed

  39. Status

    Program status changed

  40. Scope removed

    955837609

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from www.intigriti.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

HERE Technologies is a global leader in digital mapping and location technology. We provide a comprehensive location data and technology platform that enables people, businesses, and cities to move forward by leveraging the power of location intelligence.

Our platform includes web applications, APIs, mobile applications, and cloud-based infrastructure that support a wide range of use cases. Customers can integrate their own data, maps, services, logic, and algorithms to enrich location-based insights and build scalable solutions.

Given the nature of our platform, our systems may process sensitive location data, customer data, and enterprise integrations, making security and data protection a top priority.

Rules of engagement

Our promise to you

We know how it could be frustrating sometimes to wait for a response after submitting a vulnerability report (been there) and we want to ensure you that we will be in touch with you within following timelines:

  • 2 business days for every exceptional and critical severity issue you report
  • 5 business days for every high severity issue
  • 10 business days for every medium severity issue
  • 15 business days for every low severity issue

Depending on issue severity our promise is to be in touch with you on regular bases to provide updates from our side.

  • We are happy to respond to any questions, please use the button in the right top corner for this.
  • We respect the safe harbor clause that you can find below

Your promise to us

  • All reports should be written in English
  • Provide detailed but to the point reproduction steps
  • Include a clear attack scenario. How will this affect us exactly?
  • Remember: quality over quantity!
  • Please do not discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo)
  • Please do not use automatic scanners (be creative and do it yourself!). We cannot accept any submissions found by using automatic scanners. Scanners also won't improve your skills, and can cause a high server load (we'd like to put our time in thanking researchers rather than blocking their IP's 😉)

In scope

We have worked to remediate known critical and high-severity issues and now invite the security community to help us identify any remaining vulnerabilities.

1. Web Application

Key Objectives

We are primarily interested in vulnerabilities that may lead to:

  • Authentication bypass
  • Authorization bypass
  • Unauthorized access to internal infrastructure

High-Impact Vulnerabilities

We are particularly interested in (but not limited to) the following classes of vulnerabilities:

  • Privilege escalation (horizontal or vertical, including account takeover and auth bypass)
  • Cross-Site Scripting (XSS) — excluding self-XSS; only valid on latest browser versions
  • Remote Code Execution (RCE)
  • Injection vulnerabilities (SQL, NoSQL, LDAP, etc.)
  • Broken authentication mechanisms
  • Sensitive data exposure
  • XML External Entity (XXE)
  • Broken access control
  • Insecure deserialization

2. Mobile Application

Areas of Interest

We are particularly interested in identifying vulnerabilities in the following areas (but not limited to):

  • SSO implementation issues
  • Exposed application components or data (e.g., shared libraries, exported components)
  • Deep link handling vulnerabilities
  • Forgotten or exposed development/debug API endpoints not intended for production use
  • Information disclosure via APIs
  • Client-side code injection
  • Authorization issues
  • Authentication issues
  • User data stored in publicly accessible directories
  • Hardcoded secrets used for sensitive operations

3. Employee Accounts

The following accounts are considered in scope:

  • Active employee accounts under the @here.com domain across services hosted on:
    • *.here.com (excluding unverified accounts on account.here.com)
    • here.okta.com

Out of scope

1. General

The following reports are not eligible:

  • Duplicate reports (issues already known to the company)
  • Theoretical issues without a realistic exploitation scenario or attack surface
  • Issues requiring unrealistic or overly complex user interaction
  • Reports without proof of concept (e.g., claims of outdated/vulnerable software only)

Disallowed attack categories

  • Spam, social engineering, or physical intrusion
  • DoS / DDoS / brute-force attacks
  • Attacks requiring:
    • Physical access
    • Man-in-the-middle (MITM)
    • Compromised user accounts

Software & vulnerability lifecycle

  • Vulnerabilities affecting unsupported or end-of-life software
  • Recently disclosed zero-day vulnerabilities (within 14 days of patch release) — may be accepted but are typically not eligible for a bounty

2. Prohibited Testing

The following activities are strictly prohibited:

Automated testing & brute force

  • Automated scans or brute-force attempts
  • High-volume requests with parameter/value guessing (e.g., login, search, forms)
  • More than 10 requests per second

Denial of Service

  • DoS attacks
  • DDoS attacks
  • Any form of high-load or stress testing

3. Web Out-of-Scope Findings

The following are out of scope unless a clear business impact is demonstrated:

Low-impact misconfigurations & best-practice issues

  • SSL/TLS misconfigurations without server-side impact
  • Missing security headers or cookie flags (Secure, HttpOnly, SameSite)
  • Lack or bypass of rate limiting
  • Password policy issues (complexity, expiration, reuse)
  • XML-RPC enabled
  • Failure to strip metadata from files

Low-impact client-side or UI issues

  • Self-XSS without impact on other users
  • Clickjacking without realistic exploitation
  • Reverse tabnabbing
  • Presence of autocomplete attribute on forms
  • CSV injection
  • Same-site scripting
  • Content injection without ability to modify HTML

Information disclosure (non-sensitive)

  • API key disclosure without proven impact
  • WordPress username disclosure
  • Username/email enumeration
  • Banner grabbing / version disclosure
  • Verbose errors or directory/file listings without sensitive data
  • Tokens leaked to third parties without demonstrated risk
  • Disclosed or misconfigured Google Maps API keys

Network & protocol issues (no proven impact)

  • CORS misconfiguration on non-sensitive endpoints
  • CSRF with low or no impact
  • HTTP request smuggling without proven impact
  • Host header injection without proven impact
  • Blind SSRF without proven impact (e.g., pingbacks alone are insufficient)

Unsupported or incomplete exploitation scenarios

  • Pre-auth account takeover / OAuth squatting
  • Subdomain takeover without actual takeover
  • Arbitrary file upload without proof of upload/access
  • Session not invalidated (e.g., after logout or enabling 2FA)
  • Email bombing
  • Homograph attacks
  • Issues related to email spoofing (SPF, DKIM, DMARC)

4. Mobile Out-of-Scope Findings

Platform limitations & expected behaviors

  • Clipboard data leakage
  • URI leakage via malicious apps with permissions
  • Runtime exploitation possible only on jailbroken/rooted devices

Missing protections (best practices)

  • Absence of certificate pinning
  • Lack of obfuscation
  • Lack of anti-debugging or binary protections
  • Absence of jailbreak/root detection

Low-impact disclosures

  • Sensitive data in URLs/request bodies when protected by TLS
  • Path disclosure in binaries
  • Snapshot/pasteboard leakage
  • API key leakage used for non-sensitive actions

Stability issues

  • Crashes caused by malformed URL schemes

5. Leaked Credentials & Secrets

The following are out of scope:

  • Credentials belonging to customers or end users (e.g., personal accounts, passwords, API keys, tokens not owned or controlled by the company)
  • Non-working or invalid credentials (e.g., expired, revoked, or otherwise unusable secrets)

Severity

This program follows Intigriti's triage standards

FAQ

Where can we get credentials for the app?

You can self-register on the application but please don’t forget to use your @intigriti.me address.