- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 6
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- https://bugs.ikea.com/
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Only CRITICAL and HIGH vulnerabilities that have been resolved might receive an award and it is a solely decission by IKEA.
- Response
-
Within 2 days
Time to first response (from report submit) - 2 business days
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
6 assets you may test, 28 excluded.
Wildcard domains 2
- ikea.*
- *.ikea.com
Domains 1
- ikea.com
Hardware and IoT 1
- IKEA HomeSmart Products
Products and areas 2
- any other IKEA branded domain/service
- IKEA Mobile Applications
Out of scope (28)
- Account enumeration using brute-force attacks
- Any activity that could lead to the disruption of our service (DoS).
- Attacks requiring MITM or physical access to a user's device.
- Clickjacking on pages with no sensitive actions
- Comma Separated Values (CSV) injection without demonstrating a vulnerability.
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Credentials obtained by malware, data leaks or shared on the dark web
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
- Issues that require unlikely user interaction
- Mail configuration issues including SPF, DKIM, DMARC settings
- Missing best practices in Content Security Policy.
- Missing cookie flags on non-sensitive cookies
- Missing HttpOnly or Secure flags on cookies
- Missing http security headers which do not lead to a vulnerability
- Open redirect - unless an additional security impact can be demonstrated
- Presence of autocomplete attribute on web forms
- Previously known vulnerable libraries without a working Proof of Concept.
- Rate limiting or bruteforce issues on non-authentication endpoints
- Reports from automated tools or scans
- Reports of SSL/TLS issues, best practices or insecure ciphers
- Self-exploitation attacks
- Social Engineering attacks
- Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
- Solutions affected by known CVEs published less than 30 days ago
- Tabnabbing
- Test versions of applications
- Vulnerabilities only affecting users of outdated or unpatched browsers
- Weak password policies and password complexity requirements
Rules
What the policy asks of you, and the bug types it won't reward, quoted from IKEA's policy. "We" in these lines means the program, not this site.
While testing
-
Do not execute or attempt to execute any “Denial of Service” attack.
-
Do not post, transmit, upload, link to, send or store any malicious software.
-
Do not test what would result in sending unsolicited or unauthorized junk mail, spam or other forms of unsolicited messages.
-
Do not run automated scans without checking with IKEA first.
-
Do not test in a manner that would corrupt the operation of IKEA solutions.
-
Do not test equipment or the physical security in IKEA stores.
-
Do not use social engineering techniques.
-
Do not test third-party applications, websites or services that integrate with or link to IKEA properties.
-
Do not publicly disclose any vulnerability before 30-day after the vulnerability is resolved by IKEA and not without IKEA's prior written consent.
-
Remove all data and sensitive information you got from the analysis once the report is submitted.
Not accepted
-
Social Engineering attacks
-
Account enumeration using brute-force attacks
-
Weak password policies and password complexity requirements
-
Missing http security headers which do not lead to a vulnerability
-
Reports from automated tools or scans
-
Presence of autocomplete attribute on web forms
-
Missing cookie flags on non-sensitive cookies
-
Reports of SSL/TLS issues, best practices or insecure ciphers
-
Self-exploitation attacks
-
Test versions of applications
-
Mail configuration issues including SPF, DKIM, DMARC settings
-
Clickjacking on pages with no sensitive actions
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Any activity that could lead to the disruption of our service (DoS).
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Rate limiting or bruteforce issues on non-authentication endpoints
-
Missing best practices in Content Security Policy.
-
Missing HttpOnly or Secure flags on cookies
-
Vulnerabilities only affecting users of outdated or unpatched browsers
-
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
-
Tabnabbing
-
Open redirect - unless an additional security impact can be demonstrated
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.