- Top reward
- $2,500
- Top severity paid
- Critical
- Assets in scope
- 23
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $2,500
- for critical bugs, from $50.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Public disclosure allowed
- You may publish your report.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$2,500 from $750 |
| High |
|
$1,500 from $500 |
| Medium |
|
$1,000 from $250 |
| Low |
|
$500 from $50 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $2,500
Scope
23 assets you may test, 17 excluded.
Web 14
- https://businessportal.origin.com.au
- https://customerportal.winconnect.com.au/login
- https://dataportal.originenergy.com.au
- https://portal.anz.kinergysolutions.com
- https://portal.originzero.com.au
- https://sign.originzero.com.au
- https://ssu.staging.myconnect.com.au/get-connected
- https://www.originenergy.com.au
- https://www.winconnect.com.au/get-connected
- https://www.winconnect.com.au/moving-out
- hub.myconnect.com.au
- myconnect.com.au
- portal.myconnect.com.au
- portal.myconnect.com.au/new-connection
Wildcard domains 5
- *.api.originenergy.com.au
- *.download.originenergy.com.au
- *.odcdn.com.au
- *.origindigital-pac.com.au
- *.support.originenergy.com.au
APIs 4
- https://api-businessportal.origin.com.au
- https://api-portal.originzero.com.au
- https://api.rx.originenergy.com.au/v1/lpg/graphql
- https://portal-api.anz.kinergysolutions.com
Out of scope (17)
- https://api.rx.originenergy.com.au/v1/gateway/schema/graphql
- https://agent.compareandconnect.com.au
- https://auth.api.originenergy.com.au/**
- https://fastconnect.co.nz
- https://manufacturers.solarquotes.com.au
- https://origin-energy.formstack.com/**
- https://raywhitehomenow.com
- https://reneweclipse.originenergy.com.au/*
- https://ssu.myconnect.com.au/**
- https://www.compareandconnect.com.au
- https://www.originenergy.com.au/moving
- https://www.solarquotes.com.au/leads
- https://www.solarquotes.com.au/quote/start
- https://www.solarquotes.com.au/quotesv2
- https://www.solarquotes.com.au/suppliers
- https://www.solarquotes.com.au/wp-admin
- https://yourporter.com.au
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Origin Energy (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
All email addresses belonging to researchers should be your @bugcrowdninja.com .
-
Any form submissions MUST use your @bugcrowdninja.com email.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
-
Do not modify data that does not belong to you.
-
Tools that may result in a Denial Of Service (DoS) are prohibited.
-
Please be sure to check domain records to confirm Origin Energy ownership; do not test assets not owned and controlled by Origin Energy.
-
The use of Automated scanners is strictly prohibited .
-
Chat functionality must not be tested.
-
Submission of any forms (sign up etc) is strictly prohibited.
-
Authenticated sections within our target may be tested provided the tester is an Origin customer and has MyAccount access. Out of scope targets must not be tested.
Not accepted
-
Logout Cross-Site Request Forgery (logout CSRF)
-
Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
-
Login or Forgot Password page brute force and account lockout not enforced.
-
Username / email enumeration/ Account Number.
-
Missing HTTP security headers, specifically (https://owasp.org/www-project-secure-headers/), e.g.
-
Strict-Transport-Security.
-
X-Frame-Options.
-
X-XSS-Protection.
-
X-Content-Type-Options.
-
Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP.
-
Content-Security-Policy-Report-Only.
-
Cache-Control and Pragma
-
SSL/TLS Issues, e.g.
-
SSL Attacks such as BEAST, BREACH, Renegotiation attack.
-
SSL Forward secrecy not enabled.
-
SSL weak/insecure cipher suites.
-
Self-XSS reports will not be accepted.
-
Volume related issues or missing rate limiting protections i.e.. Brute-force, rate-limiting, denial of service, number enumeration.
-
Social engineering of any kind against Origin employees or its users.
-
Email configuration i.e. SPF, DKIM, DMARC.
-
Error pages i.e. verbose error messages, stack traces, invalid status codes.
-
Non-sensitive exposed API keys e.g. QAS,
-
Configuration that is not directly exploitable i.e.. weak TLS ciphers, password policy, session expiration, certificate pinning.
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 27 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://www.solarquotes.com.au/quotesv2/ (out of scope)
-
Scope added
https://ssu.myconnect.com.au/** (out of scope)
-
Scope added
https://origin-energy.formstack.com/** (out of scope)
-
Scope added
https://auth.api.originenergy.com.au/** (out of scope)
-
Scope added
https://www.originenergy.com.au/moving/ (out of scope)
-
Scope added
https://ssu.staging.myconnect.com.au/get-connected
-
Scope added
portal.myconnect.com.au/new-connection
-
Scope added
https://customerportal.winconnect.com.au/login
-
Scope added
https://www.winconnect.com.au/get-connected/
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Origin Energy invites you to test and help secure our primary publicly facing assets - focusing on our web applications. We appreciate your efforts and hard work in making the internet (and Origin Energy) more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.
Targets
Rules of Engagement All email addresses belonging to researchers should be your @bugcrowdninja.com . Any form submissions MUST use your @bugcrowdninja.com email. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services. Do not modify data that does not belong to you. Tools that may result in a Denial Of Service (DoS) are prohibited. Please be sure to check domain records to confirm Origin Energy ownership; do not test assets not owned and controlled by Origin Energy. The use of Automated scanners is strictly prohibited . Chat functionality must not be tested. Submission of any forms (sign up etc) is strictly prohibited. Access A large portion of targets are public facing are unauthenticated. Authenticated sections within our target may be tested provided the tester is an Origin customer and has MyAccount access. Out of scope targets must not be tested. 3rd Party Services Origin Energy uses several third-party providers and services – including a number hosted on subdomains of originenergy.com.au. We DO NOT authorize security testing against systems that do not belong to us, but strongly suggest reporting issues identified within these services to the third-party directly. If you believe an issue with one of our third-party service providers is the result of Origin Energy's misconfiguration or insecure usage of that service (or you've reported an issue affecting many customers of the service that you believe Origin Energy can temporarily mitigate without stopping usage of the service while a fix is implemented upstream), we'd appreciate your report regarding the issue. Areas of Focus We are especially interested in critical vulnerabilities that result in the unauthorized disclosure of Personally Identifiable Information (PII) Of importance are vulnerabilities that subvert business controls e.g. offer redemption, discounts etc. We're also interested in traditional web application vulnerabilities, as well as other vulnerabilities that have demonstrable impact to Origin Energy and/or our customers. Below is a list of some of the vulnerability classes that we are seeking reports for: Server-side Remote Code Execution (RCE) Server-Side Request Forgery (SSRF) Stored/Reflected Cross-site Scripting (XSS) Cross-site Request Forgery (CSRF) SQL Injection (SQLi) XML External Entity Attacks (XXE) Access Control Vulnerabilities (Insecure Direct Object Reference issues, etc) Exclusions Logout Cross-Site Request Forgery (logout CSRF) Lack of Secure/HTTPOnly flags on non-sensitive Cookies. Login or Forgot Password page brute force and account lockout not enforced. Leaked or compromised credentials obtained from third-party sources (e.g., public data breaches, paste sites, credential dumps) rather than through direct exploitation of Origin Energy systems or infrastructure. Username / email enumeration/ Account Number. Missing HTTP security headers, specifically (https://owasp.org/www-project-secure-headers/), e.g. Strict-Transport-Security. X-Frame-Options. X-XSS-Protection. X-Content-Type-Options. Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP. Content-Security-Policy-Report-Only. Cache-Control and Pragma SSL/TLS Issues, e.g. SSL Attacks such as BEAST, BREACH, Renegotiation attack. SSL Forward secrecy not enabled. SSL weak/insecure cipher suites. Self-XSS reports will not be accepted. Volume related issues or missing rate limiting protections i.e.. Brute-force, rate-limiting, denial of service, number enumeration. Social engineering of any kind against Origin employees or its users. Email configuration i.e. SPF, DKIM, DMARC. Error pages i.e. verbose error messages, stack traces, invalid status codes. Non-sensitive exposed API keys e.g. QAS, Configuration that is not directly exploitable i.e.. weak TLS ciphers, password policy, session expiration, certificate pinning. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further. Note: Origin Energy uses CVSS to consistently score security vulnerabilities. Where discrepancies between the VRT and CVSS score exist, Origin Energy will defer to the CVSS score to determine the priority.
Winconnect (in scope)
Winconnect public facing assets