- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 22
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 1 day
- As the policy promises.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
There is currently no official bug bounty program at IONOS, but we are inducting outstanding ethical security researchers into our Hall of Fame .
- Response
-
Within 1 days
We typically reply within one working day.
- Safe harbor
-
Full
IONOS will not seek prosecution of any security researcher who reports, in good faith and in accordance with this policy, any security vulnerability on an in-scope IONOS service.
- Hall of fame
-
Yes
There is currently no official bug bounty program at IONOS, but we are inducting outstanding ethical security researchers into our Hall of Fame .
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
22 assets you may test, 3 excluded.
Domains 11
- stand out with .app, .nyc, .dev, and more No bounty
- www.ionos.com/ai-domain-name-generator No bounty
- www.ionos.com/domains/ai-domain No bounty
- www.ionos.com/domains/bulk-domain-search No bounty
- www.ionos.com/domains/com-domain No bounty
- www.ionos.com/domains/domain-guard No bounty
- www.ionos.com/domains/domain-names No bounty
- www.ionos.com/domains/domain-transfer No bounty
- www.ionos.com/domains/org-domain No bounty
- www.ionos.com/domains/us-domain No bounty
- www.ionos.com/momentum/ai-app-builder No bounty
Products and areas 11
- ai Domain No bounty
- AI Domain Name Generator No bounty
- Bulk Domain Search No bounty
- com Domain No bounty
- Domain Names No bounty
- Find your domain name faster with AI No bounty
- IONOS products and services
- New Top-Level Domains No bounty
- org Domain No bounty
- Register up to 50 domains with one search No bounty
- us Domain No bounty
Out of scope (3)
- Denial of Service vulnerability (i.e. overwhelming our services with a high volume of requests)
- Reports indicating that our services do not fully align with "best practice" (e.g. missing security headers or suboptimal email-related configurations such as SPF, DMARC etc.)
- TLS configuration specifics (e.g. no support for TLSv1.3, a specific cipher suite configuration, etc.)
Rules
What the policy asks of you, and the bug types it won't reward, quoted from IONOS's policy. "We" in these lines means the program, not this site.
While testing
-
Please refrain from reporting them to us:
-
Do not include sensitive data, such as your password in your description.
-
Please do not send us confidential information such as your password or any other person-related data!
-
Please keep the subject line intact and use the identifier in all further correspondence.
-
You’re welcome to enquire on the status of the process but please limit this to no more than once every 14 days.
Not accepted
-
Denial of Service vulnerability (i.e. overwhelming our services with a high volume of requests)
-
TLS configuration specifics (e.g. no support for TLSv1.3, a specific cipher suite configuration, etc.)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.