Mollie

Bug bounty on Self-hosted mollie.com

Accepting reports

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash: Yes We make an appropriate monetary reward available for reports that actually lead to remedying a vulnerability or a change in our services.
Response: Within 3 days You will receive confirmation of receipt from Mollie within three business days after the report.
Safe harbor: Partial Mollie will treat your report confidentially and will not share your information with third parties without your permission, unless this is required by law or by a court order.
Hall of fame: Yes If you wish, Mollie will mention your name as the discoverer in the reporting on the problem.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

1 asset you may test, 9 excluded.

Out of scope (9)

What the policy asks of you, and the bug types it won't reward, quoted from Mollie's policy. "We" in these lines means the program, not this site.

Do not share information about the security problem with others until the problem is resolved.
Provide information about how and when the vulnerability or malfunction occurs.
Do not perform any actions beyond those necessary to demonstrate the security problem.
Do not abuse the vulnerability and do not keep confidential data obtained through the vulnerability in the system.
Do not use physical attacks, DDOS attacks or social engineering.
Our responsible disclosure policy is not an invitation to actively scan our company network for vulnerabilities.

(D)DOS attacks
Problems that amount to self-XSS
Error messages without sensitive data
Reports from which software we use can be deduced
Problems that require the use of heavily outdated operating systems, browsers or – obsolete plug ins
Problems that are already known to us

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake