Van Lanschot Kempen

Bug bounty on Self-hosted vanlanschotkempen.com

Accepting reports KYC to get paid

Go to program Website

At a glance

What to know before you start testing.

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Pays cash: Yes As a token of our gratitude for your assistance, we offer a reward for every report of a vulnerability that we are actually able to resolve or that leads to a change in our services.
Response: Within 2 days A team of security experts will investigate your report and will provide an initial response within two working days.
Safe harbor: Partial If you act in good faith, with integrity, and in careful compliance with the rules as stated below, the bank will have no reason to press charges.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

16 assets you may test.

What the policy asks of you, and the bug types it won't reward, quoted from Van Lanschot Kempen's policy.

Please make sure that you do not cause any damage with the vulnerability you have discovered.
Under no circumstances may your actions lead to a deliberate interruption of the services or to disclosure of bank or client data.
Please refrain from using social engineering to gain access to a system.
Do not use automated scanners to detect vulnerabilities (such as Burp Suite Scanner, Acunetix, etc.).
Do not install a backdoor in an information system so that you can subsequently demonstrate its vulnerability, as this may cause additional damage as well as unnecessary security risks.
Limit the use of a vulnerability to an absolute minimum. Do only what is necessary to establish the vulnerability.
Do not change or remove any data from the system and exercise maximum restraint in copying data (if one single record will suffice to demonstrate the problem, stop there and do not continue).
Do not make any system changes.
Do not repeatedly try to gain access to the system. Once you have gained access, do not share it with others.
Do not use brute force to gain access to systems. After all, repeatedly trying passwords has very little to do with detecting vulnerabilities.

All notifications without a clear report with evidence of possible exploitation
Submissions must originate from direct human research and analysis, reports generated or authored by AI tools will not be accepted
Issues with respect to SPF/DKIM/DMARC records
Fingerprinting/version banner disclosure on common/public services
Publicly accessible files and directories with non-sensitive information (e.g., robots.txt)
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality
Cross Site Request Forgery (CSRF) vulnerabilities on static pages and logout functionality
Brute force attacks against ‘Forgot password’ pages
Redirection from HTTP to HTTPSHTTP OPTIONS enabled
Host Header Injection
HTML does not specify charset
HTML uses unrecognized charset
Lack of ‘Secure’/‘HTTPOnly’ flags on non-sensitive cookies
Clickjacking-related issues
User enumeration on websites that do not process online payment transactions
Possibly outdated server or application versions (of external parties) without evidence that these versions are vulnerable and without proof of operation
Reports of unsafe SSL/TLS protocols and other misconfigurations
Generic vulnerabilities related to software or protocols that do not fall under the control of Van Lanschot Kempen
Distributed Denial of Service (DDoS) attacks
Spam or Social Engineering techniques
Reports of regular scans, such as port scanners

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Rewards, scope and stats come from the company's own pages and are checked several times a day.
Policy text is summarised with AI. Every quoted line is checked word for word against the source before it is shown.
The program's own policy always wins. Read it before you test.

Original policy Report a mistake