OVO

Vulnerability disclosure program on security.txt ovoenergy.com

Accepting reports Full safe harbor security.txt

Go to program Website

At a glance

What to know before you start testing.

No cash rewards: A disclosure program: you report for credit, not money.
Report by email: https://ovo.tines.com/pages/d7e2f76cb5216ff95b0c6c4509524b5b/
Full safe harbor: Good-faith research is authorised; no legal action.
No public write-ups: Keep findings private.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No OVO does not currently operate a paid bug bounty programme. We do not offer financial compensation, gift vouchers, or merchandise in exchange for reported vulnerabilities.
Safe harbor: Full We will not initiate legal action against you.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

53 assets you may test.

What the policy asks of you, and the bug types it won't reward, quoted from OVO's policy.

Do not perform testing that degrades, disrupts, or compromises the availability of any service (e.g. disk operating system) or impacts OVO customers.
If you encounter personally identifiable information or payment card industry data, stop immediately.
Do not view, download, or alter any data beyond what is strictly necessary to prove the existence of the vulnerability (e.g. capturing a masked screenshot).
You must maintain full confidentiality.
Do not disclose vulnerability details or the existence of a report outside of the designated reporting channel below.
Do not target OVO employees, contractors, or customers with phishing, vishing, or physical attacks.
Only the assets listed as in-scope are authorised for testing. Any assets not listed here are strictly excluded.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 12 Nov 2026. Last checked 2 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Valid until 31 Dec 2026

Read the file Among the top 52,000 websites

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake