- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 29
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs, from $100.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$4,500 from $1,500 |
| High |
|
$2,500 from $700 |
| Medium |
|
$500 from $100 |
| Low |
|
$100 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $4,500
Scope
29 assets you may test, 1 excluded.
Web 17
- https://10bis.co.il
- https://bistro.sk
- https://jet-external.com
- https://just-eat.ch
- https://just-eat.co.il
- https://just-eat.com
- https://just-eat.es
- https://lieferando.de
- https://pyszne.pl
- https://scoober.com
- https://skippayments.com
- https://skipthedishes.com
- https://takeaway.com
- https://www.just-eat.co.uk
- https://www.justeattakeaway.com
- https://www.thuisbezorgd.nl
- https://yourdelivery.de
Android apps 4
- https://play.google.com/store/apps/developer?id=10bis.co.il+ltd.
- https://play.google.com/store/apps/developer?id=Just-Eat+Holding+Limited
- https://play.google.com/store/apps/developer?id=Skip+Canada
- https://play.google.com/store/apps/developer?id=Takeaway.com
iOS apps 4
- https://apps.apple.com/it/developer/takeaway-com-central-core-b-v/id329472762
- https://apps.apple.com/nz/developer/just-eat-com/id383091095
- https://apps.apple.com/us/developer/10bis-co-il-ltd/id434368194
- https://apps.apple.com/us/developer/skipthedishes/id969229980
APIs 3
- https://api.justeat-int.com
- https://just-data.io
- https://just-eat.io
Products and areas 1
- https://github.com/justeattakeaway
Out of scope (1)
- *.business.just-eat.co.uk
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Just Eat Takeaway.com (via Bugcrowd)'s policy.
While testing
-
Testing is only authorized on the targets listed as In-Scope.
-
Please add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior.
-
To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address.
-
do not target other user's data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users.
-
If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding.
-
purchasing of goods on the platform will be at your own risk & cost
Not accepted
-
Vulnerabilities or reports lacking a working Proof of Concept (PoC)
-
P5 vulnerabilities
-
Vulnerabilities dependent on random customer IDs (basketID, orderID, sessionID etc.)
-
Supply chain attacks without proof of JET infrastructure callback (IP/hostname).
-
AI generated reports without proper research, validation, or containing hallucinations will be rejected and marked as Non-applicable.
-
Public buckets with static content, source maps, or generic info disclosure (versions, tech stack, errors).
-
Missing server-side checks without privilege escalation (low-to-high privilege).
-
Subdomain takeovers without proof of successful exploitation, dangling CNAMEs are not eligible.
-
DoS/DDoS/Network DoS
-
Rate limiting bypass attempts
-
Email bombing flooding
-
Session persistence concerns (e.g., valid session remaining post-logout).
-
SSL/TLS configurations
-
DNS settings (e.g., SPF, DMARC)
-
Cookie configurations (e.g., flags, expiration policies)
-
Mobile security mechanisms (e.g., pinning, protection measures)
-
Absence of standard security headers (e.g., HSTS, CSP)
-
Open redirects are marked as informative and closed
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 54 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://just-eat.co.il
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Just Eat Takeaway.com values the security of its customers, partners and employees. We invite security researchers to test our public-facing defenses, helping us strengthen our platform. Ratings and rewards: We follow the Bugcrowd Vulnerability Rating Taxonomy for the initial classification of reported issues. This means certain vulnerability types have a capped to maximum level of severity. We may adjust prioritization based on real-world likelihood and business impact to JustEatTakeaway.com ’s platform. Submissions based purely on automated scanning output are generally not accepted unless they uncover a clearly significant issue. If a submission is reprioritized or downgraded, we will provide a detailed explanation and invite the researcher to appeal with further evidence or reasoning. Focus areas: We prioritize actionable vulnerabilities with direct business or operational impact: account takeovers, payment bypasses, customer data disclosure, authentication bypasses, and impactful business logic flaws. Reports must demonstrate clear exploitability, and findings without proper impact explanation may be considered bugs rather than security issues.
Targets
General Guidance We align with the Bugcrowd Vulnerability Rating Taxonomy , which defines the maximum severity for each vulnerability type. This means that certain findings, such as Reflected XSS , are capped at a maximum of P3 , regardless of impact or context. Severity assessments are bound by the vulnerability category and do not escalate beyond the capped level defined in the taxonomy. Some resources, URLs, and applications share the same codebase. As a result, identical vulnerabilities across different domains, URLs, or subdomains will be treated as duplicates. However, some functionalities may differ, meaning certain features could exist on one domain but not on another. This applies to “staging”, “dev” and other environments. If you find the same vulnerability on multiple instances, such as the same URL affecting different API endpoints or domains, please report them in a single ticket to be considered for additional recognition rewards. Otherwise, they will be treated as duplicates. Testing is only authorized on the targets listed as In-Scope. Any domain/property of JustEatTakeaway not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please inquire through the Bugcrowd Support Portal before submitting. Behavior that compromises the stability and integrity of the site is out of scope (specifically the production environment). For example, do not target other user's data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. For all other sites in this scope, purchasing of goods on the platform will be at your own risk & cost , we hope to provide additional test credentials, payments & restaurants in the future. User Agent Requirement Please add the following header to your HTTP traffic to prevent interruptions and verify non-malicious behavior. This will help the Just Eat team identify that activity is coming from a researcher on the program and ensure that your testing is not blocked or interrupted. X-Bug-Bounty: Credentials To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Excluded Submission Types Vulnerabilities or reports lacking a working Proof of Concept (PoC), require significant user action (e.g., disabling browser security settings) or are tied to outdated or unsupported devices/software. P5 vulnerabilities Vulnerabilities dependent on random customer IDs (basketID, orderID, sessionID etc.), f.e. get/update basket content by knowing it's ID, are considered to be not eligible and be marked as Out of Scope. We are interested only in methods that allows to disclose such ID's in a mass and without interaction. Supply chain attacks without proof of JET infrastructure callback (IP/hostname). AI generated reports without proper research, validation, or containing hallucinations will be rejected and marked as Non-applicable. Similarly, automated tool results without manual verification and working PoC are not eligible. Public buckets with static content, source maps, or generic info disclosure (versions, tech stack, errors). Missing server-side checks without privilege escalation (low-to-high privilege). Admin-to-admin or high-to-high privilege issues are considered as low priority bug. Subdomain takeovers without proof of successful exploitation, dangling CNAMEs are not eligible. Dev and staging environments operate with demo data, so debug functionality available in these environments is not eligible unless paired with critical findings affecting production. Availability/volumetric testing e.g.: DoS/DDoS/Network DoS Rate limiting bypass attempts Email bombing flooding Session persistence concerns (e.g., valid session remaining post-logout). Vulnerabilities that are best practices or recommendations , including: SSL/TLS configurations DNS settings (e.g., SPF, DMARC) Cookie configurations (e.g., flags, expiration policies) Mobile security mechanisms (e.g., pinning, protection measures) Absence of standard security headers (e.g., HSTS, CSP) Open redirects are marked as informative and closed N-day/Third party 0-day Policy When N-Day bugs are released to the public, we will consider these as in scope after 30 days has gone by e.g: N-day released on 01/01/2025, we would consider it in-scope on 31/01/2025 Out of Scope Interacting or manipulate other stakeholders and their associated accounts including: Social engineering attacks Phishing attacks Physical attacks Third party providers and services Potential post-exploitation scenarios : If you believe you've identified a vulnerability that may lead to post-exploitation activity including modification or destruction of data please stop testing and submit your finding. We will work with you to evaluate the vulnerability and award you accordingly for the final impact and severity. Generally every subdomain pointing to *.leadfamly.com or *.playable.com. Stolen/Breached Credentials If you happen to identify vulnerabilities involving data that has been exposed or leaked such as dark web forums or leaked credential sites. You can report it to this engagement. However, be aware that it is only eligible for points-based compensation. This policy helps maintain the highest standard of operational confidentiality, integrity, and compliance. Statement of non-eligibility Employees of JustEatTakeaway.com and all its subsidiaries (including former employees that separated from Takeaway.com within the prior 12 months), contingent workers, contractors and their personnel, and consultants, as well as their immediate family members and persons living in the same household are not eligible to receive bounties or rewards of any kind under this program. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. We’re committed to supporting good-faith research and collaboration. If you’re unsure whether an action is permitted, please refer bugcrowd and rules before attempting If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the Bugcrowd Support Portal before going any further.
Business assets (in scope)
Same vulnerabilities found across applications, domains, subdomains, or environments (e.g., staging, dev) - may share the same codebase and will be treated as duplicates unless clear functional differences exist; related findings should be submitted in a single report for potential recognition, otherwise they may not be eligible for separate rewards. Focus areas - Authentication and authorization issues, business logic abuse
Mobile applications (in scope)
Server-side vulnerabilities discovered through mobile applications fall under "Business Platforms and APIs" scope. Vulnerabilities requiring rooted/jailbroken devices are out-of-scope. Vulnerabilities requiring ADB access, physical device access, install of the malware app or WebView exploitation are also out-of-scope. We are looking for 0-click or 1-click vulnerabilities. Focus areas: Secrets leakage, mobile misconfigurations
Other assets (in scope)
Focus areas - SQL Injections, RCE, auth bypasses, exfiltration of sensitive or PII data
Source code and supply chain (in scope)
We accept reports related to supply chain security, GitHub Actions vulnerabilities, and credential leakage, but not code-level vulnerabilities in repositories (such as XSS, SQL injection, etc.) unless they can be demonstrated to impact systems covered under "Business Platforms and APIs" scope. Focus Areas: Leaked credentials with proven access to JET systems, supply chain attacks (dependency confusion, malicious injection, typosquatting) with verified JET infrastructure callbacks, active secrets in repositories/containers/configurations