Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

TomTom

Vulnerability disclosure program on HackerOne tomtom.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
4
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Replies within 5 days
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Response
Within 5 days We will acknowledge receipt of your report within 5 business days.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

4 assets you may test.

Wildcard domains 3

  • *.tomtom.com Critical No bounty
  • *.tomtom-global.com Critical No bounty
  • *.tomtomgroup.com Critical No bounty

Source code 1

  • https://github.com/tomtom-international/* Critical No bounty

Rules

What the policy asks of you, and the bug types it won't reward, quoted from TomTom (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Do not publicly disclose the vulnerability before we have had a reasonable time to address it.
  • Do not exploit the vulnerability beyond what is necessary to demonstrate its existence.
  • Do not access or modify any user data without explicit permission.
  • Do not use attacks on physical security, social engineering, distributed denial of service or spam;
  • Do not attack third-party applications, systems, or products
  • Act in good faith and with the intention of improving our security.

Not accepted

  • Phishing, vishing, or other social engineering attacks.
  • Access to buildings or data centers.
  • Attacks that aim to disrupt service availability.
  • Sending unsolicited messages.
  • Automated attempts to guess passwords.
  • Reports of clickjacking without a clear security impact.
  • CSRF on forms with minimal security impact (e.g., contact forms).
  • Vulnerabilities that require the user to execute the attack themselves.
  • Missing headers (e.g., X-Frame-Options) without a clear security consequence.
  • General security advice or recommendations.
  • Vulnerabilities in libraries or frameworks, unless related to our implementation.
  • If a newer, patched version is available.
  • Vulnerabilities that have already been disclosed.
  • Cases where email verification is not enforced.
  • Session issues without demonstrable impact on user security.
  • Reports about missing complexity requirements (e.g., length, special characters).
  • Open redirections without direct impact on account compromise or data disclosure.
  • Any testing that could damage or alter repository content or functionality.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 4 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    *.tomtom-global.com

  2. Scope added

    *.tomtom.com

  3. Scope added

    *.tomtomgroup.com

  4. Scope added

    https://github.com/tomtom-international/*

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

TomTom is committed to maintaining the highest level of security for our products, services, and users. We appreciate your efforts in identifying and reporting potential security vulnerabilities in our systems and applications.

This policy outlines our commitment to working with security researchers to resolve vulnerabilities responsibly.

#In-Scope:

  • *.tomtom-global.com
  • *.tomtomgroup.com
  • *.tomtom.com
  • GitHub Organization: tomtom-international
    • Public repositories only
    • Archived repositories are excluded
Included in GitHub Repositories Excluded from GitHub Repositories
Source code in all public repositories Private repositories
Configuration and deployment files Production infrastructure
Dependencies and third-party integrations Third-party dependencies hosted elsewhere
Documentation that may contain security-sensitive information Archived repositories

#Out of Scope: The following vulnerabilities are generally considered out of scope for our program:

Category Description
Social engineering Phishing, vishing, or other social engineering attacks.
Physical security Access to buildings or data centers.
Denial of service (DoS) Attacks that aim to disrupt service availability.
Spamming Sending unsolicited messages.
Password brute-forcing Automated attempts to guess passwords.
Clickjacking without impact Reports of clickjacking without a clear security impact.
CSRF on low-impact forms CSRF on forms with minimal security impact (e.g., contact forms).
Self-XSS Vulnerabilities that require the user to execute the attack themselves.
Missing security headers without impact Missing headers (e.g., X-Frame-Options) without a clear security consequence.
Best practice suggestions General security advice or recommendations.
Third-party library issues Vulnerabilities in libraries or frameworks, unless related to our implementation.
Outdated software versions If a newer, patched version is available.
Publicly known vulnerabilities Vulnerabilities that have already been disclosed.
Email not verified for account registration Cases where email verification is not enforced.
Insufficient session logout Session issues without demonstrable impact on user security.
Weak password policy Reports about missing complexity requirements (e.g., length, special characters).
Open redirections without impact Open redirections without direct impact on account compromise or data disclosure.
Destructive testing on repositories Any testing that could damage or alter repository content or functionality.

#What You Can Expect From Us:

  • We will acknowledge receipt of your report within 5 business days.
  • We will investigate your report and keep you informed of our progress.
  • We will work with you to understand and validate the vulnerability.
  • We will remediate the vulnerability in a timely manner.

#What We Expect From You:

  • Do not publicly disclose the vulnerability before we have had a reasonable time to address it.
  • Do not exploit the vulnerability beyond what is necessary to demonstrate its existence.
  • Do not access or modify any user data without explicit permission.
  • Do not use attacks on physical security, social engineering, distributed denial of service or spam;
  • Do not attack third-party applications, systems, or products
  • Act in good faith and with the intention of improving our security.

#Disclosure Policy: Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization. Follow HackerOne's disclosure guidelines: https://www.hackerone.com/disclosure-guidelines

Thank you for your interest and help in protecting the security of TomTom's products and services.