- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
The exact amount paid out depends on the impact of the identified vulnerability.
- Safe harbor
-
Partial
stick to the responsible disclosure principles - you give us the time we need for fixing the vulnerability before making it public
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 1 excluded.
Domains 1
- mail.com
Web 1
- Logged-in web apps that process customer data, such as email, calendar and file storage, including their authentication
Products and areas 1
- the web applications within the authenticated area processing customer data (i.e. the products like email, calendar or file storage, including the authentication systems)
Out of scope (1)
- All other systems
Rules
What the policy asks of you, and the bug types it won't reward, quoted from United Internet AG's policy. "We" in these lines means the program, not this site.
While testing
-
you have not put any real customer data at risk - use a test account if needed for Proof of Concept
-
stick to the responsible disclosure principles - you give us the time we need for fixing the vulnerability before making it public
-
are the first one who has found the issue (regardless of the brand of the product - e.g. email interface at WEB.DE, GMX and mail.com counts as one product)
Not accepted
-
Product features (e.g. sharing of data, SPAM-related topics)
-
Malware-related issues (e.g. sending e-mails with infected attachments)
-
Issues which are not directly possible to exploit (e.g. missing security headers, information leakage)
-
Issues which are only exploitable using physical or logical access to the victim's device/account (e.g. self-XSS)
-
Issues limiting the availability of services/data (e.g. logout CSRF
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.