Norddeutsche Rundfunk (NDR)
Vulnerability disclosure program on security.txt ndr.de
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 16
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Due to the NDR funding system, it is currently not possible to provide any payment or any kind of bounty for any found flaw in our systems.
- Response
-
Within 2 days
You can expect an initial feedback to your request in the first 48h.
- Safe harbor
-
Full
Within the framework of the legal system, we will consider activities conducted consistent with this policy to constitute "authorized" conduct and will not pursue civil action or initiate a complaint to law enforcement.
- Hall of fame
-
Yes
However, as a token of appreciation we would like to add our helping security researches to our appreciation list.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
16 assets you may test.
Domains 8
- ard.de
- brisant.de
- eurovision.de
- mdr.de
- ndr.de
- ndrmedia.de
- sportschau.de
- tagesschau.de
Wildcard domains 8
- *.ard.de
- *.brisant.de
- *.eurovision.de
- *.mdr.de
- *.ndr.de
- *.ndrmedia.de
- *.sportschau.de
- *.tagesschau.de
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Norddeutsche Rundfunk (NDR)'s policy. "We" in these lines means the program, not this site.
While testing
-
Brute force
-
Denial of service (DDoS)
-
Injecting Malware
-
Social engineering (e.g. phishing etc.)
-
Corrupting Data
-
Any method that would disrupt our services
-
Any method that would impair the distribution of our broadcasts
-
Any method that would be otherwise illegal
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
-
Only interact with accounts you own or with explicit permission of the account holder.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.