Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

SBAB

By SBAB Bank AB (publ) Vulnerability disclosure program on Self-hosted sbab.se

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Not published
Assets in scope
6
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report by email
[email protected]
Partial safe harbor
Some legal protection; read the terms.
Replies within 3 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What the company's own policy page says it pays.

This program does not pay cash rewards.

Pays cash
No This is not a bug bounty program. Financial compensation is not offered.
Response
Within 3 days Acknowledge receipt within three business days , where contact information is available.
Safe harbor
Partial Where a researcher acts in good faith, complies with this policy and promptly reports identified vulnerabilities, SBAB will not pursue civil claims solely on the basis of such authorized security research.
Hall of fame
Yes Researchers who wish to be publicly acknowledged may request inclusion in SBAB's Hall of Fame .

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

6 assets you may test, 9 excluded.

APIs 1

  • APIs and authentication services.

Products and areas 5

  • Customer-facing applications and services.
  • Other systems operated or controlled by SBAB.
  • publicly accessible, internet-facing websites, applications and APIs operated or controlled by SBAB Bank AB (publ)
  • Public websites and internet-facing applications.
  • SBAB-operated cloud services and infrastructure.
Out of scope (9)
  • Development, staging and test environments.
  • Employee devices, corporate endpoints and internal workstations.
  • External SaaS platforms and services outside SBAB's control.
  • Internal networks and non-public infrastructure.
  • Physical security systems and facilities.
  • Services or infrastructure for which SBAB does not have the authority to permit security testing.
  • Social media platforms.
  • Systems, accounts or information belonging to SBAB customers or other third parties.
  • Third-party and supplier-operated services, including outsourced services and critical ICT third-party providers, unless SBAB has expressly authorized their testing.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from SBAB's policy.

While testing

  • Be conducted in good faith and with minimal impact on SBAB's systems and services.
  • Use only accounts and data owned by the researcher or expressly authorized for testing.
  • Avoid excessive requests, service degradation or disruption.
  • Avoid unauthorized access to, modification or disclosure of information belonging to others.
  • Be limited to the minimum activity reasonably necessary to identify and verify a suspected vulnerability.
  • Stop immediately if testing causes unexpected system behavior, service degradation or exposure of sensitive information.
  • Stop verification once sufficient evidence of a vulnerability has been obtained.
  • Researchers must not expand testing to excluded systems, third-party services or other targets outside the Authorized Testing Scope.
  • Automated security testing: Automated vulnerability scanning, systematic discovery, fuzzing, enumeration or other automated security testing techniques.
  • Disruptive testing: Denial-of-service, stress, load or resource-exhaustion testing, or any activity that could adversely affect service availability or performance.

Not accepted

  • Missing security headers without demonstrable security impact.
  • Software version disclosure without an applicable exploitable weakness.
  • Missing cookie attributes without demonstrable security impact.
  • Informational findings generated by automated scanners.
  • Speculative vulnerabilities without sufficient supporting evidence.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Reward terms

    The reward table or payout terms were edited

  2. Reward raised

    Maximum no amount → no amount

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.