SAP Invitational Bug Bounty Program
By SAP Bug bounty on Bugcrowd
- Top reward
- $20,000
- Top severity paid
- Critical
- Assets in scope
- 25
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $20,000
- for critical bugs, from $250.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Payment
- Proof of identity needed to get paid.
- Public disclosure allowed
- You may publish your report.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$20,000 from $4,000 |
| High |
|
$7,500 from $2,000 |
| Medium |
|
$2,500 from $700 |
| Low |
|
$600 from $250 |
- Safe harbor
-
Full
All SAP programs are fully committed to providing safe harbor for good-faith security research.
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $20,000
Scope
25 assets you may test.
Web 25
- Gardener
- SAP AI Core
- SAP Business Network for Asset Collaboration
- SAP Business Network for Logistics
- SAP BusinessObjects Business Intelligence platform
- SAP BusinessOne
- SAP Cloud ALM
- SAP Concur
- SAP Continuous Integration and Delivery
- SAP Customer Data Cloud portfolio from Gigya
- SAP Customer Data Platform
- SAP Decentralized Identity Verification
- SAP Integrated Business Planning for Supply Chain
- SAP Order and Delivery Scheduling
- SAP Order Management foundation
- SAP Risk and Assurance Management
- SAP S/4HANA Cloud Private Edition
- SAP S/4HANA Cloud Public Edition
- SAP S/4HANA migration cockpit
- SAP Signavio Process Intelligence
- SAP Signavio Process Management
- SAP SuccessFactors Employee Central
- SAP SuccessFactors Recruiting Marketing
- SAP WalkMe
- SAP Watch List Screening
Rules
What the policy asks of you, and the bug types it won't reward, quoted from SAP Invitational Bug Bounty Program (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
All penetration testing and automated scanning activities must be conducted in a manner that does not impact the performance or availability of our systems.
-
Destructive practices including Denial of Service (DoS) attacks, resource exhaustion, DNS poisoning, rootkit installation, and similar activities are strictly prohibited.
-
Additionally, testers must refrain from using real Personally Identifiable Information (PII) during testing.
-
Please do not submit any reports to this Private Invitational Program (i.e. do not click Submit report button above).
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
SAP Concur
-
Scope added
Gardener
-
Scope added
SAP BusinessOne
-
Scope added
SAP AI Core
-
Scope added
SAP Signavio Process Management
-
Scope added
SAP Signavio Process Intelligence
-
Scope added
SAP WalkMe
-
Scope added
SAP BusinessObjects Business Intelligence platform
-
Scope added
SAP Watch List Screening
-
Scope added
SAP Business Network for Asset Collaboration
-
Scope added
SAP Order and Delivery Scheduling
-
Scope added
SAP Decentralized Identity Verification
-
Scope added
SAP Business Network for Logistics
-
Scope added
SAP Order Management foundation
-
Scope added
SAP Continuous Integration and Delivery
-
Scope added
SAP Risk and Assurance Management
-
Scope added
SAP S/4HANA migration cockpit
-
Scope added
SAP Customer Data Platform
-
Scope added
SAP Customer Data Cloud portfolio from Gigya
-
Scope added
SAP Cloud ALM
-
Scope added
SAP Integrated Business Planning for Supply Chain
-
Scope added
SAP S/4HANA Cloud Private Edition
-
Scope added
SAP S/4HANA Cloud Public Edition
-
Scope added
SAP SuccessFactors Recruiting Marketing
-
Scope added
SAP SuccessFactors Employee Central
-
Scope added
SAP Concur
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
Please read this first 🔎 Please do not submit any reports to this Private Invitational Program (i.e. do not click Submit report button above). In order to submit reports to SAP program's please read the full instructions below. All submissions reported to this page will be marked as Not Applicable If you are not eligible to participate but would nevertheless like to responsibly disclose a vulnerability, please submit here . What is this? 🌟 This initiative aims to recruit new security researchers into SAP's private bug bounty engagements. We're excited for the possibility of you joining and testing our applications! Are you up to the task? 🌟 At SAP, our purpose is to help the world run better and improve people’s lives. Our promise is to innovate to help our customers run at their best. SAP is committed to helping every customer become a best-run business. Our company recognizes the importance of security, privacy and community, and values the input of hackers acting in good-faith to help us maintain a high standard for our users. This includes encouraging responsible vulnerability research and the disclosure of security vulnerabilities. Eligibility Before we jump in, there are a few things we have to check. In order to be invited to SAP's bug bounty engagements, you have to meet the following criteria: 🔏 SAP's Customers, Partners & employees excluded ✅ You must have a background check completed through Bugcrowd, if you haven't already. 🔏 You must sign an NDA between you and SAP. 🎯 You must have an accuracy rating of at least 80% and a valid P3 or greater submission. Please refrain from submitting an application if you don't meet the accuracy rating requirement. Rewards and incentives: what do I get out of it? 🕵️ You will be invited to the bug bounty engagements listed below that include many of SAP's biggest applications, offering a wide selection of targets to choose from with authenticated access . These applications are used by millions of users each day! 💸 SAP is committed to respond to you on a timely manner, communicate regularly about the progress of your submissions, and reward you fairly for your work according to the current market. I'm sold, how do I apply? 📝 Please create a support ticket here and select the Hacker Request Type Special Engagement: SAP Hacker Application , as shown in the screenshot below: ➡️ The subject must be SAP Hacker Application <Your_Username> . Bugcrowd will verify that you meet the eligibility requirements and invite you to the relevant programs. Due to the high volume of applications, applications may take up to 4 weeks for review and processing. We highly appreciate your patience!
Targets
Testing is only authorized on the targets listed as in scope . Any domain/property of SAP not explicitly listed is out of scope. This includes any/all subdomains/sites not specifically mentioned. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to SAP, you can report it here . However, be aware that it is not eligible for rewards or points-based compensation. All penetration testing and automated scanning activities must be conducted in a manner that does not impact the performance or availability of our systems. Destructive practices including Denial of Service (DoS) attacks, resource exhaustion, DNS poisoning, rootkit installation, and similar activities are strictly prohibited. Additionally, testers must refrain from using real Personally Identifiable Information (PII) during testing. Safe Harbor All SAP programs are fully committed to providing safe harbor for good-faith security research. Reminder All submissions reported to this page will be marked as Not Applicable
Our products (in scope)
Disclaimer Each SAP product is different and rewards may vary between engagements. We aim to offer competitive rewards and promotions on a regular basis. Our highest paying engagements offers up to $20,000 for P1 findings!