- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 34
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
We only consider paying a monetary bounty for vulnerabilities of critical severity.
- Safe harbor
-
Partial
If you follow the rules below, we will not be threatening you with legal action.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
34 assets you may test, 1 excluded.
Source code 11
- All open source projects in the GitHub organizations pretix , pretix-unofficial , and venueless (excluding forked or archived repositories)
- django-hierarkey
- django-i18nfield
- django-scopes
- https://github.com/raphaelm/django-hierarkey No bounty
- https://github.com/raphaelm/django-i18nfield No bounty
- https://github.com/raphaelm/django-scopes No bounty
- https://github.com/raphaelm/python-fints No bounty
- https://github.com/raphaelm/python-sepaxml No bounty
- python-fints
- python-sepaxml
Android apps 5
- pretixLEAD
- pretix Marketplace Client
- pretixPOS
- pretixPRINT
- pretixSCAN
iOS apps 5
- pretixLEAD
- pretix Marketplace Client
- pretixPOS
- pretixPRINT
- pretixSCAN
Web 5
- https://cdn.pretix.space
- https://marketplace.pretix.eu
- https://pretix.eu
- https://pretixstatus.com
- https://vnls.io
Desktop and binaries 4
- pretixKIOSK
- pretixSCAN
- pretixSCAN Proxy
- pretixTURNSTILE
Domains 2
- rami.io No bounty
- venueless.events
Wildcard domains 1
- *.venueless.events
Products and areas 1
- Proprietary pretix plugins sold as part of our pretix Enterprise offering
Out of scope (1)
- forked or archived repositories
Rules
What the policy asks of you, and the bug types it won't reward, quoted from pretix GmbH's policy. "We" in these lines means the program, not this site.
While testing
-
Only access the data necessary to demonstrate that the vulnerability exists.
-
Do not take any actions that attempt to harm our users, confidentiality of our customer's data or availability of our systems.
-
Do not modify or delete any data not owned by you.
-
Do not impact the availability of any of our internal or external services (e.g. through DDoS or similar attacks).
-
Do not implement backdoors or use similar methods to obtain persistent access.
-
Do not send phishing emails or use any other social engineering techniques.
Not accepted
-
Denial-of-service attack vectors
-
Brute-force attack vectors
-
Rate-limiting issues
-
Issues that can only be exploited in combination with significant other security flaws that have not been found (e.g. XSS without CSP bypass)
-
Logic bugs in our business logic
-
HTTP or email header best practices
-
SPF/DKIM/DMARC best practices
-
TLS cipher best practices
-
Any reports generated primarily by LLMs
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.