New Blue Website (NBW) - VWFS Bug Bounty Program
By Volkswagen Financial Services AG Bug bounty on Bugcrowd vwfs.de
- Top reward
- $4,500
- Top severity paid
- Critical
- Assets in scope
- 20
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $4,500
- for critical bugs, from $175.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$4,500 from $3,500 |
| High |
|
$2,500 from $1,500 |
| Medium |
|
$750 from $500 |
| Low |
|
$225 from $175 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $4,500
Scope
20 assets you may test.
Web 20
- https://www.vwfs.co.in
- https://www.vwfs.com.ar
- https://www.vwfs.com.au
- https://www.vwfs.com.br
- https://www.vwfs.com.tw
- https://www.vwfs.co.za
- https://www.vwfs.cz
- https://www.vwfs.de
- https://www.vwfs.dk
- https://www.vwfs.es
- https://www.vwfs.fr
- https://www.vwfs.gr
- https://www.vwfs.ie
- https://www.vwfs.it
- https://www.vwfs.kr
- https://www.vwfs.mx
- https://www.vwfs.nl
- https://www.vwfs.pl
- https://www.vwfs.pt
- https://www.vwfs.sk
Rules
What the policy asks of you, and the bug types it won't reward, quoted from New Blue Website (NBW) - VWFS Bug Bounty Program (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
Testing is only authorized on the targets listed as in scope.
-
Testing is unauthenticated only.
-
we request that you send a custom header with every request: { x-bugcrowd-tester: (your-Bugcrowd-username) }
-
Do not test on any other subdomains other than www.
-
we kindly request that you refrain from submitting multiple reports for each site, as they will be considered duplicates.
Not accepted
-
Any form and type of social engineering
-
Contacting our agents/customer support
-
Third Party Applications and Scripts
-
Load testing and rate limiting issues
-
D/DOS (However "Application self-DOS" is in scope )
-
Third party services
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
New Blue Website (NBW) (vwfs.de) At VWFS.de, we are an online platform that offers a wide range of financial products and services specifically designed for Volkswagen Group customers. With VWFS.de, we understand that purchasing a vehicle is a significant decision, which is why we offer flexible financing options tailored to our customers specific requirements. Whether they`re looking for a loan, leasing, or other financing solutions, our goal is to make owning a Volkswagen vehicle simpler and more attainable. In addition to financing, we also offer insurance products. Our comprehensive coverage options provide peace of mind, so customers can enjoy their vehicle without worrying about unexpected events. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Testing is only authorized on the targets listed as in scope. Any domain/property of Volkswagen Financial Services AG not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Target Information: Credentials Testing is unauthenticated only. Access-Header: In order for our team not to lock you out from our applications due to suspicious behavior, we request that you send a custom header with every request: { x-bugcrowd-tester: (your-Bugcrowd-username) } General Out-of-Scope Any form and type of social engineering Contacting our agents/customer support Third Party Applications and Scripts Load testing and rate limiting issues D/DOS (However "Application self-DOS" is in scope ) Third party services VWFS uses a number of third-party providers and services – including a number hosted on subdomains of VWFS domains that will be considered OOS for this program. We cannot authorize security testing against systems that do not belong to us, but strongly suggest reporting issues identified within these services to the third party directly. However, if you believe an issue with one of our third-party service providers is the result of VWFS's misconfiguration or insecure usage of that service. Or you've reported an issue affecting many customers of the service that you believe VWFS can temporarily mitigate without stopping usage of the service while a fix is implemented upstream), we'd appreciate your report regarding the issue. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.
In Scope Targets (in scope)
Target Information Do not test on any other subdomains other than www. All submissions that are on other subdomains will be marked as Out-Of-Scope. New Blue Websites (vwfs) The NBW is an international platform for brand marketing websites that is used in a multitude of subsidiaries. It serves as marketing page and entry point for various further applications (such as banking and customer journey); sometimes, a subset of data is passed into these applications. Focus areas Injection of faulty/malicious data into the customer journeys; all attacks in which other customers are impaired. Important All apps within the scope utilize the same codebase, which means that any vulnerability discovered will be applicable to all apps. Therefore, we kindly request that you refrain from submitting multiple reports for each site, as they will be considered duplicates. Your cooperation in reporting just one instance is greatly appreciated.