- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
This is a vulnerability disclosure program. The only bounty you can receive are the points you might receive for the platform.
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 3 excluded.
Wildcard domains 2
- *.myndr.net Critical No bounty
- *.myndr.nl Informational No bounty
Web 1
- www.myndr.nl Medium No bounty
Out of scope (3)
- mqtt2.myndr.net
- mqtt.myndr.net
- pnp.myndr.net
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Myndr (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
-
Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with explicit permission of the account holder.
-
Performing actions that may negatively impact Myndr or its users (for instance Denial of Service attacks, brute-force, spam)
-
Accessing, or attempting to access, data or information that does not belong to you
-
Social engineering (including phishing) any Myndr service desk, employee or contractor
-
Any physical or electronic attack against Myndr property or data centers
-
Violating any laws or breaching any agreements in order to discover vulnerabilities
Not accepted
-
User account hacks that require user interaction
-
bugs in embedded third party services like Intercom support chat
-
Chat filter bugs
-
Missing autocomplete attributes
-
Missing flags on cookies that don’t house any sensitive information
-
SSL/TLS scan reports (this means output from sites such as SSL Labs) and SSL/TLS version related vulnerabilities
-
Missing security-related HTTP headers which do not lead directly to a vulnerability.
-
Denial of Service vulnerabilities (DoS)
-
Cross-site Request Forgery (CSRF) with minimal security implications (For example but not limited to login/logout/unauthenticated)
-
Version information disclosure (without verifying the presence of an actual exploitable vulnerability)
-
Password complexity related vulnerabilities
-
Unverified or incomplete "Scanner output" or scanner-generated reports
-
Vulnerabilities requiring physical access to the victim's unlocked device
-
Bugs requiring exceedingly unlikely user interaction
-
Disclosure of public information and information that does not present significant risk
-
Language used in emails and policy documents
-
SPF, DKIM or DMARC issues on sub-domains of myndr.nl
-
HTML injection vulnerabilities with no direct risk
-
Social engineering or following a link will not be considered for bounty
-
Self XSS or similar vulnerabilities
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
pnp.myndr.net (out of scope)
-
Scope added
mqtt2.myndr.net (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
No technology is perfect, and Myndr believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly.
Disclosure Policy
- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
- This is a vulnerability disclosure program. The only bounty you can receive are the points you might receive for the platform.
Exclusions
While researching, we'd like to ask you to refrain from:
- Performing actions that may negatively impact Myndr or its users (for instance Denial of Service attacks, brute-force, spam)
- Accessing, or attempting to access, data or information that does not belong to you
- Destroying or corrupting, or attempting to destroy or corrupt, data or information that does not belong to you
- Social engineering (including phishing) any Myndr service desk, employee or contractor
- Any physical or electronic attack against Myndr property or data centers
- Violating any laws or breaching any agreements in order to discover vulnerabilities
The following vulnerabilities typically will not qualify for our program:
- User account hacks that require user interaction
- bugs in embedded third party services like Intercom support chat
- Chat filter bugs
- Missing autocomplete attributes
- Missing flags on cookies that don’t house any sensitive information
- SSL/TLS scan reports (this means output from sites such as SSL Labs) and SSL/TLS version related vulnerabilities
- Missing security-related HTTP headers which do not lead directly to a vulnerability. Issues that only affect a smaller user base (e.g. users on outdated browsers or other outdated software).
- Denial of Service vulnerabilities (DoS)
- Cross-site Request Forgery (CSRF) with minimal security implications (For example but not limited to login/logout/unauthenticated)
- Version information disclosure (without verifying the presence of an actual exploitable vulnerability)
- Password complexity related vulnerabilities
- Unverified or incomplete "Scanner output" or scanner-generated reports
- Vulnerabilities requiring physical access to the victim's unlocked device
- Bugs requiring exceedingly unlikely user interaction
- Disclosure of public information and information that does not present significant risk
- Vulnerabilities that Myndr determines to be an accepted risk will not be eligible for a paid bounty
- Language used in emails and policy documents
- SPF, DKIM or DMARC issues on sub-domains of myndr.nl
- HTML injection vulnerabilities with no direct risk
- Social engineering or following a link will not be considered for bounty
- Self XSS or similar vulnerabilities
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep Myndr and our users safe!