- Top reward
- $6,500
- Top severity paid
- Critical
- Assets in scope
- 1
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $6,500
- for critical bugs, from $300.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Public disclosure allowed
- You may publish your report.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$6,500 from $3,001 |
| High |
|
$3,000 from $801 |
| Medium |
|
$800 from $501 |
| Low |
|
$500 from $300 |
- Safe harbor
-
Full
we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $6,500
Scope
1 asset you may test, 26 excluded.
Web 1
- https://pentest-app.onetrust.com
Out of scope (26)
- https://app.vendorpedia.com
- https://*.convercent.com
- https://*.cookielaw.org
- https://*.cookiepro.com
- https://*.dataguidance.com
- https://developer.onetrust.com
- https://*.esgiq.com
- https://my.onetrust.com
- https://*.onetrust.com
- https://*.onetrust.de
- https://*.onetrust.es
- https://*.onetrust.fr
- https://*.onetrustgrc.com
- https://*.onetrust.it
- https://*.onetrustpro.com
- https://*.onetrust.se
- https://*.preferencechoice.com
- https://*.privacyconnect.com
- https://*.privacypedia.com
- https://*.privacytech.com
- https://*.redacted.ai
- https://*.sharedassessments.org
- https://store.onetrust.com
- https://*.trustweek2021.com
- https://tv.onetrust.com
- https://*.vendorpedia.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from OneTrust (via Bugcrowd)'s policy.
While testing
-
Testing is only authorized on the targets listed as In-Scope.
-
The targets will be accessed through a OneTrust staging environment.
-
Please do not modify any credentials that were not assigned or created by yourself.
-
Please do not modify the Email Settings in the settings page as it will disrupt any new user creations.
-
All POCs submitted must be executable by OneTrust and re-creatable outside the confines of the bug bounty environment.
-
Please submit a single report.
Not accepted
-
SPF/DKIM/DMARC-Related Issues
-
Findings related to Insecure Storage
-
EXIF data present in images
-
Authorization issues without escalating privileges to full Site Admin
-
Missing Security Best Practices, i.e. Security Headers, Mixed content, SSL/TLS, etc.
-
XSS is out of scope if html sanitization is disabled.
-
Social Engineering
-
Rate-limiting issues
-
Concurrent login caching API calls
-
Session validation after password reset or change
-
Password Policy
-
tinyMCE vulnerabilities
-
CSRF vulnerabilities
-
Host header injection without proof of user data extraction
-
DoS/DDoS
-
Autocomplete attribute on web forms
-
Software Version Disclosure and verbose error pages (without proof of exploitability)
-
Open ports without an accompanying proof-of-concept demonstrating vulnerability
-
Disclosure of known public files or directories
-
Use of outdated software/library versions
-
Clickjacking on pages with no sensitive actions
-
Recently disclosed (<30 days) zero-day vulnerabilities where a patch is unavailable
-
Submissions from current OneTrust employees or those who have worked at OneTrust within the last 12 months
-
Submissions from customers or companies performing penetration tests on behalf of customers
-
Submissions made from any environment other than pentest-app.onetrust.com are ineligible for bounties and will be deemed out of scope
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 13 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Ratings/Rewards: Please note that rewards within a Priority Range are determined by CVSS score. For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Testing is only authorized on the targets listed as In-Scope. Any domain/property of OneTrust not listed in the targets section is out of scope. This includes any/all subdomains not listed above._ If you believe you've identified a vulnerability on a system outside the scope, please reach out to Bugcrowd Support before submitting and note that these will not be eligible for compensation. Program Rules: Vulnerability reports on the same vulnerability across different endpoints or targets belonging to this program are not eligible for multiple rewards. Please submit a single report. Failure to do so may result in denial of bounty. Access: The targets will be accessed through a OneTrust staging environment. Submissions made using any environment other than pentest-app.onetrust.com is ineligible for a bounty . Credentials: Credentials can be retrieved from the retrieve credential section of the brief. With that email address, you can perform a Forgot Password password reset to gain access to the account. The forgot password email will take a few minutes to arrive in your inbox. The provided account is an admin level credential and from there you will be able to create multiple credentials of varying credential levels for testing. Please do not modify any credentials that were not assigned or created by yourself. Focus Areas: Exfiltration of customer/user data Critical Modules Consumer Rights Portal (Data Subject Requests) Webforms and workflows are the key areas of this module Integrations Module Entering customer environments and pulling customer data or metadata from the environments Additional Notes: OneTrust does not pay for hypothetical vulnerabilities. All POCs submitted must be executable by OneTrust and re-creatable outside the confines of the bug bounty environment. When Bugcrowd responds to you with "As an attacker I could", OneTrust expects you to use this as a direction and to provide a POC demonstrating that "could". If your submission includes the phrase "an attacker could use this to gain access to your mind!", we expect you to have already done it too. Any such suggested phrasing is ignored during our review if it is not included in the POC. Please do not modify the Email Settings in the settings page as it will disrupt any new user creations. Out-of-Scope Out-of-Scope items include, but are not limited to: SPF/DKIM/DMARC-Related Issues Findings related to Insecure Storage EXIF data present in images Authorization issues without escalating privileges to full Site Admin Missing Security Best Practices, i.e. Security Headers, Mixed content, SSL/TLS, etc. XSS is out of scope if html sanitization is disabled. Social Engineering Rate-limiting issues Concurrent login caching API calls Session validation after password reset or change Password Policy tinyMCE vulnerabilities CSRF vulnerabilities Host header injection without proof of user data extraction DoS/DDoS Autocomplete attribute on web forms Software Version Disclosure and verbose error pages (without proof of exploitability) Open ports without an accompanying proof-of-concept demonstrating vulnerability Disclosure of known public files or directories Use of outdated software/library versions Clickjacking on pages with no sensitive actions Recently disclosed (<30 days) zero-day vulnerabilities where a patch is unavailable Submissions from current OneTrust employees or those who have worked at OneTrust within the last 12 months Submissions from customers or companies performing penetration tests on behalf of customers Submissions made from any environment other than pentest-app.onetrust.com are ineligible for bounties and will be deemed out of scope Please note that we reserve the right not to reward findings related to database or password leaks, in order to avoid encouraging grey-area activities Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support before going any further.