- Top reward
- $10,000
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $10,000
- for critical bugs, from $3,000.
- Report on Bugcrowd
- Submit through the program page.
- Public disclosure allowed
- You may publish your report.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$8,000 from $6,000 |
| High |
|
$5,000 from $3,000 |
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $8,000
Scope
13 assets you may test, 9 excluded.
Web 11
- https://shop.lululemon.com
- https://www.eu.lululemon.com
- https://www.lululemon.co.jp
- https://www.lululemon.com.au
- https://www.lululemon.com.hk
- https://www.lululemon.co.nz
- https://www.lululemon.co.uk
- https://www.lululemon.de
- https://www.lululemon.es
- https://www.lululemon.fr
- http://www.lululemon.co.kr
iOS apps 1
- https://apps.apple.com/us/app/lululemon/id920098546
Wildcard domains 1
- *.lululemon.com
Out of scope (9)
- AEM - Assets
- AEM - Sites
- https://careers.lululemon.com
- https://fr.shop.lululemon.com
- https://info.lululemon.com
- https://pnimage.lululemon.com
- https://www.lululemon.me
- https://www.mirror.co
- *.lululemon.cn
Rules
What the policy asks of you, and the bug types it won't reward, quoted from lululemon (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
Respect our users' privacy.
-
Do not retain user data
-
Don't violate our Terms of Service or the law.
-
Don't impact our services.
-
Do not perform or attempt testing on items that are out scope
-
Follow Bugcrowd's rules.
Not accepted
-
Reports rated P3 (Medium) or below are no longer accepted
-
Low-impact, theoretical, or best-practice findings without meaningful security impact will be closed as out of scope.
-
Insider-only access, leaked internal credentials, or physical access scenarios do not qualify
-
Exposure of a single data element alone does not qualify
-
credentials (or access due to credentials) from some unrelated data breach are out of scope
Summarised with AI from the program policy on Bugcrowd, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
-
Back
Open for reports again.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Status
Program status changed
-
Status
Program status changed
-
Scope removed
█████████████████████████████ (out of scope)
-
Scope removed
████████████████████████
-
Scope removed
██████████████ (out of scope)
-
Scope removed
██████████████████████████
-
Scope removed
█████████████████████ (out of scope)
-
Scope removed
████████████████████████████
-
Scope removed
███████████████████████████
-
Scope removed
██████████████████
-
Scope removed
████████████ (out of scope)
-
Scope removed
███████████ (out of scope)
-
Scope removed
██████████████████████████████ (out of scope)
-
Scope removed
███████████████
-
Scope removed
██████████████████████████
-
Status
Program status changed
-
Scope added
AEM - Sites (out of scope)
-
Scope added
AEM - Assets (out of scope)
-
Scope added
https://pnimage.lululemon.com (out of scope)
-
Scope added
https://info.lululemon.com (out of scope)
-
Scope added
https://careers.lululemon.com/ (out of scope)
-
Scope added
https://www.mirror.co/ (out of scope)
-
Scope added
https://fr.shop.lululemon.com (out of scope)
-
Scope added
*.lululemon.cn (out of scope)
-
Scope added
https://www.lululemon.me (out of scope)
-
Scope added
AEM - Sites
-
Scope added
AEM - Assets
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
lululemon invites you to test and help secure our assets - We appreciate your efforts and hard work in making us more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting! Program Ground Rules Respect our users' privacy. Do not retain user data Don't violate our Terms of Service or the law. Don't impact our services. Participation Eligibility. Follow Bugcrowd's rules. Do not perform or attempt testing on items that are out scope Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Bugcrowd Program Updates - April 2026 Bounty Structure P1 (Critical): $6,000 – $8,000 P2 (High): $3,000 – $5,000 Rewards are based on demonstrated impact, exploitability, and report quality. Severity Acceptance Changes Reports rated P3 (Medium) or below are no longer accepted Researchers are encouraged to: Chain vulnerabilities where applicable Demonstrate higher-impact exploitation paths Escalate findings to meet P2 or P1 severity criteria Provide other context or circumstances that would qualify as a qualifying severity Low-impact, theoretical, or best-practice findings without meaningful security impact will be closed as out of scope. In-Scope Assets Web & Domains shop.lululemon.com *.lululemon.com https://www.lululemon.com.au https://www.lululemon.de https://www.lululemon.es https://www.eu.lululemon.com https://www.lululemon.fr https://www.lululemon.com.hk http://www.lululemon.co.jp http://www.lululemon.co.kr https://www.lululemon.co.nz https://www.lululemon.co.uk https://www.mirror.co https://www.lululemonstudio.com Mobile Lululemon Mobile App (iOS) Out-of-Scope Assets *.lululemon.cn https://fr.shop.lululemon.com *.lululemon.me General website testing or non-security QA issues Special Rewards Remote Unauthorized Access to Customer Databases or Datastores Up to $16,000 Qualifying impact: Remote, unauthorized access to customer databases or datastores Ability to read, modify, extract, or delete customer data (please do not destroy live data) Access obtained without valid credentials or intended administrative privileges Notes: Exploit must be externally reachable Insider-only access, leaked internal credentials, or physical access scenarios do not qualify Account Takeover (ATO) — No User Interaction Required Up to $16,000 A complete compromise of a customer account requiring zero interaction from the affected user. Requirements : Full account takeover, including access to and modification of sensitive data (e.g., PII and/or PCI) No user interaction at any stage (e.g., no clicks, credential entry, email interaction, or device actions) Vulnerability must clearly demonstrate that the customer is not the initiating risk vector Common qualifying vulnerability classes include (but are not limited to) Authentication or authorization bypass SQL injection (SQLi) Arbitrary code execution Remote code execution (RCE) Server-side access control failures leading to account compromise Account Takeover (ATO) — Single User Interaction Up to $13,000 A complete compromise of a customer account requiring exactly one intentional action by the user. Requirements: One user interaction only (e.g., single mouse click, keypress, or mobile tap) Interaction must not involve credential entry or multi-step workflows Results in full account takeover Requires a full proof of concept, not just components that assume other vulnerabilities exist Examples of qualifying interaction: Clicking a single phishing or malicious URL Additional criteria: Authentication bypass occurs via existing customer-facing entry points (e.g., login, order tracking, returns, checkout) Impact includes ATO or access control failure affecting one or more of the following: Checkout process Customer PII and/or PCI data Gift card balance or redemption Limitations / exclusions: Payloads or techniques cannot be reused to claim multiple high-tier rewards Issues relying solely on weaknesses in third‑party or niche authentication providers may not qualify unless directly attributable to our implementation Unauthorized Access to Composite Customer PII / PCI Data No User Interaction Required Up to $10,000 Unauthorized exposure of multiple high-risk customer data elements without any customer action. Requirements: No user interaction Vulnerability must be reproducible across multiple customer accounts Exposure of a single data element alone does not qualify (see below) Must be repeatable for multiple users Must be related to a vulnerability with Lululemon applications or infrastructure Qualifying data sets (one required): Full name and shipping address (see limitations) Full credit card details Login credentials (see limitations) Full order history and shipping address Limitations / exclusions: Lululemon is not responsible for customer password practices across other sites, so credentials (or access due to credentials) from some unrelated data breach are out of scope Additional Notes about the Program Severity and reward determination consider impact, exploitability, scope, and reproducibility Clear proof-of-concept demonstrating real-world risk is required Chained vulnerabilities may qualify where the chain is clearly documented Duplicate or previously reported issues may result in reduced or no reward Lululemon security team has discretion to accept or decline report without provide full context to research; our goal is engage in fair and respectful communications around our decisions
International e-commerce sites (in scope)
Some websites in these countries/regions are subject to enhanced legal and regulatory obligations for protecting personal information. lululemon expects strict compliance with Bugcrowd terms and conditions relating to PII when testing these sites. Acknowledging that these 10 sites come from a common code base, when a researcher reports a flaw, it is assumed that the flaw may apply to all 10 sites. A discovered flaw for one of these sites will be considered as a duplicate when reported for one of the other websites within the International e-Commerce group.
AEM Systems (out of scope)
Exploits with severity: P3-P5
lululemon Studio (out of scope)
Exploits with severity: P3-P5