SAS Scandinavian Airlines

Accepting reports Full safe harbor

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash: No SAS does not currently operate a Bug Bounty programme and does not offer financial rewards, EuroBonus points, gifts, compensation, or other incentives in exchange for vulnerability reports.
Response: Within 7 days SAS aims to acknowledge receipt of vulnerability reports within seven (7) business days.
Safe harbor: Full SAS will not initiate legal action against researchers for activities that: are conducted in a good-faith manner, comply with this policy, avoid harm, disruption, or privacy violations, are promptly reported to SAS.
Hall of fame: No or maintain a future responsible disclosure recognition programme or Hall of Fame.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

8 assets you may test, 5 excluded.

Out of scope (5)

3 rd party systems, supplier platforms, airport systems, alliance partners, or partner airlines
aircraft systems, avionics, onboard systems, crew systems, airport operational systems, ground support equipment, operational technology (OT), or safety-critical environments
internal infrastructure or non-public environments
payment systems, cardholder data environments, or financial transaction flows beyond non-invasive validation
Third-party providers, supplier platforms, airport systems, alliance partner environments, and externally hosted services

What the policy asks of you, and the bug types it won't reward, quoted from SAS Scandinavian Airlines's policy.

Take only the steps necessary to demonstrate the vulnerability
Avoid exploiting vulnerabilities beyond what is necessary to prove their existence
Immediately stop testing if personal data, operational data, credentials, tokens, or other sensitive information is encountered
Securely delete any information inadvertently accessed
Avoid actions that could degrade, disrupt, or impair SAS systems, services, operations, or availability
Avoid persistence, privilege escalation, lateral movement, or attempts to access additional systems
Maintain confidentiality of vulnerability information unless SAS has provided explicit written approval for disclosure
Access, modify, delete, exfiltrate, or retain SAS, customer, employee, supplier, or operational data
Upload SAS information, screenshots, proof-of-concept material, or vulnerability details to public repositories, social media, or third-party sharing platforms without written approval from SAS

Scanner Outputs
Security best practices, i.e. security headers, etc.
Social engineering, phishing, vishing, smishing, or impersonation attempts
Denial-of-service (DoS), stress, load, or performance testing
Physical security testing
Credential attacks, password spraying, brute force, session hijacking, or MFA bypass attempts
Fraudulent bookings, refunds, loyalty transactions, or loyalty program (i.e. EuroBonus) activity
Malware deployment, ransomware simulation, destructive testing, or persistence mechanisms
Public disclosure before SAS has remediated the issue and provided written approval

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake