Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Mondelēz International

Vulnerability disclosure program on HackerOne mondelezinternational.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
371
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 2 days
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Response
Within 2 days HackerOne will acknowledge that the submission was received within two (2) business days of the submission date.
Safe harbor
Full Mondelēz International will not recommend or pursue legal action against authorized activities that are in accordance with this policy.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

371 assets you may test, 4 excluded.

Web 370

  • 7days-promo.com Critical No bounty
  • 7days-promo.ro Critical No bounty
  • admit-it.cadbury.co.uk Critical No bounty
  • admit-it.cadbury.ie Critical No bounty
  • aida-mdlz.com Critical No bounty
  • aladdin.marabou.se Critical No bounty
  • alpengold.me Critical No bounty
  • alpengold-promo.me Critical No bounty
  • amikekszunkjatek.hu Critical No bounty
  • ar.oreobts.com Critical No bounty
  • atistirmalikdunyasi.com Critical No bounty
  • backtoschoolsnacks.com Critical No bounty
  • barniadventures.com Critical No bounty
  • barni.org Critical No bounty
  • base-mondelez-ag.fr Critical No bounty
  • bassettsvitamins.co.uk Critical No bounty
  • bee.harmony.info Critical No bounty
  • beldent.com.ar Critical No bounty
  • belvita.life Critical No bounty
  • belvitasnacks.com Critical No bounty
  • bigwinwin.cadbury.co.uk Critical No bounty
  • bis.com.br Critical No bounty
  • biscuitspromo.com.au Critical No bounty
  • bournvita.ng Critical No bounty
  • breathewithtomtom.com Critical No bounty
  • br.oreobts.com Critical No bounty
  • brumikobjavitel.sk Critical No bounty
  • brumikobjevitel.cz Critical No bounty
  • bundakraft.com Critical No bounty
  • cadburyarabia.com Critical No bounty
  • cadburycashdrop.com.au Critical No bounty
  • cadbury.com.au Critical No bounty
  • cadbury.co.uk Critical No bounty
  • cadbury.co.za Critical No bounty
  • cadburydessertscorner.com Critical No bounty
  • cadburyfindtheticket.com.au Critical No bounty
  • cadburygems.in Critical No bounty
  • cadbury.ie Critical No bounty
  • cadburylollyrewards.com Critical No bounty
  • cadbury-made-to-share.co.za Critical No bounty
  • cadburymonopoly.com Critical No bounty
  • cadburyplaypad.com Critical No bounty
  • cadburytrytime.co.nz Critical No bounty
  • cadburyworld.co.uk Critical No bounty
  • canjeatupremiomdlz.com Critical No bounty
  • ca.oreobts.com Critical No bounty
  • cashback.tuc.eu Critical No bounty
  • castigapremii.milka.ro Critical No bounty
  • catalogohellojoy.com Critical No bounty
  • chappies.co.za Critical No bounty
  • clifbar.ca Critical No bounty
  • clifbar.com Critical No bounty
  • clifbar.com.au Critical No bounty
  • clorets.jp Critical No bounty
  • clubsocial.com.br Critical No bounty
  • cocoalife.org Critical No bounty
  • cocoaprogram.info Critical No bounty
  • coffeecallsforbelvita.com Critical No bounty
  • concorso.sottilette.it Critical No bounty
  • contactus.mdlzapps.com Critical No bounty
  • co.oreobts.com Critical No bounty
  • cotedor.com Critical No bounty
  • crisperschaussurespersonnalisees.ca Critical No bounty
  • crisperscustomkicks.ca Critical No bounty
  • croissantpromo.gr Critical No bounty
  • cr.oreobts.com Critical No bounty
  • culinaryinspoguide.com Critical No bounty
  • dairylea.co.uk Critical No bounty
  • desfrutacomphiladelphia.com Critical No bounty
  • destroyvalentinesday.com Critical No bounty
  • disfrutaconphiladelphia.com Critical No bounty
  • do.oreobts.com Critical No bounty
  • dormifelfedez.hu Critical No bounty
  • dorminyeremenyjatek.hu Critical No bounty
  • ec.oreobts.com Critical No bounty
  • ejackson.co.uk Critical No bounty
  • enjoylifefoods.ca Critical No bounty
  • enjoylifefoods.com Critical No bounty
  • estate2026.fonzies.it Critical No bounty
  • eu.clifbar.com Critical No bounty
  • extra.milka.de Critical No bounty
  • familiaterrabusi.com.ar Critical No bounty
  • fattorieosella.it Critical No bounty
  • favourites.milka.com Critical No bounty
  • favourites.milka.de Critical No bounty
  • fcmilka.de Critical No bounty
  • fidorka.cz Critical No bounty
  • figaro.cz Critical No bounty
  • figaro.sk Critical No bounty
  • fonzies.it Critical No bounty
  • freiafotballtur.no Critical No bounty
  • freia.no Critical No bounty
  • fun.cadbury.co.uk Critical No bounty
  • fundraising.com.au Critical No bounty
  • game.milka.bg Critical No bounty
  • ganaconmdlz.com Critical No bounty
  • ganapremiosmdlz.com Critical No bounty
  • gethalls.ca Critical No bounty
  • gethalls.com Critical No bounty
  • gewinnspiel.milka.de Critical No bounty
  • gifting.twistandmake.com Critical No bounty
  • give-a-little-thanks.cadbury.co.za Critical No bounty
  • giveawaygiveaway.cadbury.co.uk Critical No bounty
  • giveawaygiveaway.cadbury.ie Critical No bounty
  • giveawaygiveaway-claim.cadbury.co.uk Critical No bounty
  • goldenernachmittag.milka.at Critical No bounty
  • goldenernachmittag.milka.de Critical No bounty
  • gourmetfood.com.au Critical No bounty
  • gratisschenken.milka.de Critical No bounty
  • greeting.twistandmake.com Critical No bounty
  • grenade.com Critical No bounty
  • guldbiljett.marabou.se Critical No bounty
  • gustaredetop.ro Critical No bounty
  • gyldne.marabou.dk Critical No bounty
  • halls.jp Critical No bounty
  • harmony.info Critical No bounty
  • haztudiadelicioso.com Critical No bounty
  • health-pro.snackmindful.com Critical No bounty
  • heritageadvertising.cadbury.co.uk Critical No bounty
  • heroes.cadbury.co.uk Critical No bounty
  • hn.oreobts.com Critical No bounty
  • hourlyjobs-us.mondelezinternational.com Critical No bounty
  • https://www.cadburygiftsdirect.co.uk Critical No bounty
  • https://www.clifbar.com Critical No bounty
  • https://www.tatesbakeshop.com Critical No bounty
  • https://xn--90aiakgkqi1l.xn--p1ai Critical No bounty
  • hukitchen.com Critical No bounty
  • id.oreobts.com Critical No bounty
  • id.oreosea.com Critical No bounty
  • id.snacksandmeals.app Critical No bounty
  • in.oreobts.com Critical No bounty
  • insights.mdlzawayfromhome.com Critical No bounty
  • instoreeggucation.com Critical No bounty
  • ir.mondelezinternational.com Critical No bounty
  • jaarlanggratis.milka.nl Critical No bounty
  • jeuconcoursmondelez26.fr Critical No bounty
  • jocca.it Critical No bounty
  • joulu.marabou.fi Critical No bounty
  • juegayganaconmdlz.com Critical No bounty
  • klubbkakan.marabou.se Critical No bounty
  • kr.oreobts.com Critical No bounty
  • kvikklunsj.freia.no Critical No bounty
  • lacta.com.br Critical No bounty
  • lacta.gr Critical No bounty
  • lajoieoreo.ca Critical No bounty
  • lajoieoreo.com Critical No bounty
  • laligaconmassabor.es Critical No bounty
  • leo.milka.be Critical No bounty
  • library.spotlightdam.com Critical No bounty
  • lidl.nyerjakedvenceiddel.hu Critical No bounty
  • liga.nl Critical No bounty
  • lojamondelez.com.br Critical No bounty
  • loteria7days.pl Critical No bounty
  • loteriamilka.pl Critical No bounty
  • loteriaoreo.pl Critical No bounty
  • lubakery.co.uk Critical No bounty
  • lubiscuits.eu Critical No bounty
  • lu.fr Critical No bounty
  • lusingingpacks.nl Critical No bounty
  • marabou.com Critical No bounty
  • matt-pokora.milka.com Critical No bounty
  • mavieencouleurs.fr Critical No bounty
  • mdlzcollaboration.com Critical No bounty
  • mdlzcusthelp.ca Critical No bounty
  • mdlzcusthelp.com Critical No bounty
  • mdlznutritionscience.com Critical No bounty
  • merendadanumeriuno.it Critical No bounty
  • mezclaydisfruta.com.ar Critical No bounty
  • miamicfsweeps.com Critical No bounty
  • miamicfsweepstakes.com Critical No bounty
  • milka.cl Critical No bounty
  • milka.com Critical No bounty
  • milka-laliga.cz Critical No bounty
  • milkamonopoly.it Critical No bounty
  • milkamozi.hu Critical No bounty
  • milkaneighbours.me Critical No bounty
  • milka-pasakyklabas.lt Critical No bounty
  • milkapromo.hu Critical No bounty
  • milka.ru Critical No bounty
  • minecraft.oreo.com.au Critical No bounty
  • mirabilandia.orosaiwa.it Critical No bounty
  • miracelwhip.de Critical No bounty
  • mitiendamondelez.com.ar Critical No bounty
  • mmmax.milka.at Critical No bounty
  • mmmax.milka.de Critical No bounty
  • mmm.marabou.se Critical No bounty
  • momentosnack.com Critical No bounty
  • mondelez-afh.co.uk Critical No bounty
  • mondelezawayfromhome.com Critical No bounty
  • mondelezcanadafoodservice.ca Critical No bounty
  • mondelezinternational.com Critical No bounty
  • mondelezinternationalnutritionscience.com Critical No bounty
  • mondelez-professional.de Critical No bounty
  • mondelezpromo.com Critical No bounty
  • mondelezvending.com Critical No bounty
  • mwtr.com Critical No bounty
  • my.oreobts.com Critical No bounty
  • my.oreosea.com Critical No bounty
  • my.rssl.com Critical No bounty
  • mysales.mdlz.com Critical No bounty
  • And 170 more on HackerOne.

Products and areas 1

  • Leaked Credentials Critical No bounty
Out of scope (4)
  • bot.cadburygifting.in
  • https://cadburygifting.in
  • https://gifts.tatesbakeshop.com
  • www.cadburygifting.in

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Mondelēz International (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Test any systems not specified in Appendix A: In-scope systems.
  • Conduct any testing that may disrupt, impair, or disable Mondelēz International systems (e.g. DoS, DDoS).
  • Engage in social engineering of Mondelēz International employees, contractors, and customers.
  • Physically test any facilities or resources (e.g., office access, tailgating), send any unsolicited or social engineering mail to any Mondelēz International users (e.g., phishing, vishing).
  • Exploit any vulnerability beyond the minimal amount of testing required to identify an indicator related to the vulnerability.
  • Compromise, copy or exfiltrate any data from any systems.
  • Test any third-party websites, applications, or services that integrate with or link to/from Mondelez International systems.
  • Carry on with the testing if you find vulnerabilities involving sensitive data, including personally identifiable information or proprietary data.
  • Discuss this program or any vulnerabilities (even resolved ones) outside of the program without express written consent (including via email) from Mondelēz International.
  • Always tag your traffic, and list your IP in the submission form.

Not accepted

  • Self XSS
  • Unauthenticated/logout/login CSRF
  • Attacks requiring MITM or physical access to a user's device
  • Any activity that could lead to the disruption of our service (DoS)
  • Missing best practices in SSL/TLS configuration
  • Content spoofing and text injection issues WITHOUT showing an attack vector/without being able to modify HTML/CSS
  • Publically-known Zero-day vulnerabilities will not be considered for eligibility until more than 30 days have passed since patch availability.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 3 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope removed

    win-tuc.cz

  2. Scope removed

    oreo-la.com

  3. Scope removed

    www.snack7days.com

  4. Scope removed

    cadbury.co.sa

  5. Scope removed

    oreokitchen.ma

  6. Scope removed

    gol.oreo.mx

  7. Scope removed

    www.promocaomisturaquecombina.com.br

  8. Scope removed

    ljmondelez.com.br

  9. Scope removed

    xn--90aiefdldtba7bg.xn--p1ai

  10. Scope removed

    vincialexdelpiero.it

  11. Scope removed

    egypt.oreostayplayful.com

  12. Scope removed

    anniversariooro.orosaiwa.it

  13. Scope removed

    fruehling-knacken.milka.de

  14. Scope removed

    concorsoesselunga.philadelphia.it

  15. Scope removed

    sportszeletjoenergiak.hu

  16. Scope removed

    suchard.bg

  17. Scope removed

    win-tuc.sk

  18. Scope removed

    oreo.bg

  19. Scope removed

    vincicoppaitalia.it

  20. Scope removed

    belvitaoffer.com

  21. Scope removed

    semester.marabou.se

  22. Scope removed

    soutez-opavia.cz

  23. Scope removed

    xn--glcksrad-75a.milka.at

  24. Scope removed

    guiaclorets.mx

  25. Scope removed

    sutaz-opavia.sk

  26. Scope removed

    lumeabarni.ro

  27. Scope removed

    concorsocoop.philadelphia.it

  28. Scope removed

    passatempo.royalcontigo.com

  29. Scope removed

    phonejeeto.com

  30. Scope removed

    concorsomikadosummernights.it

  31. Scope removed

    promo.milka.com

  32. Scope removed

    fingerscrossed.cadbury.co.uk

  33. Scope removed

    fingerscrossed.cadbury.ie

  34. Scope removed

    ligamaissabor.pt

  35. Scope removed

    admit-it-win.cadbury.co.uk

  36. Scope removed

    timeoutz4snacks.com

  37. Scope removed

    epack.mondelezinternational.com

  38. Scope added

    castigapremii.milka.ro

  39. Scope added

    7days-promo.com

  40. Scope added

    cashback.tuc.eu

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Introduction

Mondelēz International takes vulnerability disclosures seriously and appreciates the security researchers’ efforts. Mondelēz International is committed to establishing a transparent and open communication with researchers.

The Purpose of the Vulnerability Disclosure Policy (VDP) is to give security researchers clear guidelines for conducting vulnerability research, discovery, and reporting against Mondelēz International systems.

Mondelēz International accepts vulnerability findings from various sources such as independent security researchers, industry partners, or customers. Mondelēz defines a vulnerability as a technical flaw or weakness found in a system that can be leveraged to compromise the confidentiality, integrity, or availability of Mondelēz International products, services, and data. Please see the rules of engagement for security researchers below.

Legal Authorization (Safe Harbor)

If all the associated guidelines highlighted in this policy are followed during the security research, Mondelēz International will consider the research to be authorized, and will look to collaborate to understand any discovered issues quickly. Mondelēz International will not recommend or pursue legal action against authorized activities that are in accordance with this policy.

Test Instructions

When testing, you can make it easier for us to identify your testing traffic against our normal data and the malicious actors out in the world. Please do the following when participating in Mondelez VDP Program: *Where possible, register accounts using your [email protected] addresses. (see https://docs.hackerone.com/hackers/hacker-email-alias.html ) *Provide your IP address in the bug report. We will keep this data private and only use it to review logs related to your testing activity.

  • No credentials are required or provided for this program. If you self-register for any accounts, please register with your @wearehackerone.com email address. You may not use exposed credentials to continue testing without written consent from Mondelēz International. *Include a custom HTTP header in all your traffic. Burp and other proxies allow the easy automatic addition of headers to all outbound requests. Report to us what header you set so we can identify it easily. *Identifier: Your HackerOne Username *Format: X-Mondelez-VDP: HackerOne- *Example: X-Mondelez-VDP: HackerOne-H4x0r
  • ==Always tag your traffic, and list your IP in the submission form.==

Submitting a Report

  • Notify us immediately upon discovery of any real security issues.
  • HackerOne will acknowledge that the submission was received within two (2) business days of the submission date. (Requires contact information. We cannot communicate with anonymous submissions).
  • HackerOne will validate steps to reproduce, proof of concept, and severity. Further details may be requested to properly triage the submission. Below are details requested to assist with triaging the reported finding:
    • URL
    • Vulnerability description
    • Potential impact of the issue reported
    • Step-by-step re-production instructions including technical details
    • Any proof-of-concept code that is used
    • Remediation or mitigation steps for the reported issue
  • Any tools utilized to detect the issue

Rules of Engagement

Security researchers must carry out the following activities: DO:

  • Notify us immediately upon discovery of any real or potential security issues
  • Discard and purge any stored Mondelēz International data upon reporting a vulnerability finding

Out-of-Scope Vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

  • Self XSS
  • Unauthenticated/logout/login CSRF
  • Attacks requiring MITM or physical access to a user's device
  • Any activity that could lead to the disruption of our service (DoS)
  • Missing best practices in SSL/TLS configuration
  • Content spoofing and text injection issues WITHOUT showing an attack vector/without being able to modify HTML/CSS
  • Publically-known Zero-day vulnerabilities will not be considered for eligibility until more than 30 days have passed since patch availability.

Security researchers must not carry out the following activities: DO NOT:

  • Test any systems not specified in Appendix A: In-scope systems.
  • Conduct any testing that may disrupt, impair, or disable Mondelēz International systems (e.g. DoS, DDoS).
  • Engage in social engineering of Mondelēz International employees, contractors, and customers.
  • Physically test any facilities or resources (e.g., office access, tailgating), send any unsolicited or social engineering mail to any Mondelēz International users (e.g., phishing, vishing).
  • Exploit any vulnerability beyond the minimal amount of testing required to identify an indicator related to the vulnerability.
  • Compromise, copy or exfiltrate any data from any systems.
  • Test any third-party websites, applications, or services that integrate with or link to/from Mondelez International systems.
  • Carry on with the testing if you find vulnerabilities involving sensitive data, including personally identifiable information or proprietary data. In this case, you must stop your test and notify us immediately and you must not disclose this data to anyone.
  • Discuss this program or any vulnerabilities (even resolved ones) outside of the program without express written consent (including via email) from Mondelēz International.

#Processing Expectations Upon submission of the finding, the Mondelēz International team will:

  • Acknowledge that the submission was received within two (2) business days of the submission date.
  • Collaborate to validate and resolve reported vulnerability findings.

Thank you for helping keep our company and our users safe!