- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Replies within 2 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
| High |
|
$2,000 |
| Medium |
|
$1,000 |
| Low |
|
$500 |
- Response
-
Within 2 days
| First Response | 2 days |
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 34 excluded.
Web 4
- www.zooplus.com Critical
- www.zooplus.co.uk Critical
- www.zooplus.de Critical
- zooplus.net Critical
Out of scope (34)
- https://www.zoohit.cz/veterinari
- https://www.zooplus.de/tierarzt
- https://www.zooplus.es/veterinarios
- https://www.zooplus.fr/veterinaire
- https://www.zooplus.hu/allatorvos
- https://www.zooplus.it/veterinari
- https://www.zooplus.nl/dierenarts
- https://www.zooplus.pl/weterynarz
- www.bitiba.de
- www.matina-gmbh.de
- www.wolf-of-wilderness.com
- www.zoochic-eu.ru
- www.zoohit.cz
- www.zoohit.si
- www.zoohit.sk
- www.zooplus.at
- www.zooplus.be
- www.zooplus.ch
- www.zooplus.dk
- www.zooplus.es
- www.zooplus.fi
- www.zooplus.fr
- www.zooplus.gr
- www.zooplus.hr
- www.zooplus.hu
- www.zooplus.ie
- www.zooplus.it
- www.zooplus.nl
- www.zooplus.no
- www.zooplus.pl
- www.zooplus.pt
- www.zooplus.ro
- www.zooplus.se
- zooplus.io
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Zooplus (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction or mass exfiltration of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with explicit permission of the account holder.
-
To avoid problems in your test, please use a VPN with an exit node in a country in the EU.
-
Load-intensive scans should be avoided.
-
When signing up for any Zooplus account, please use your [user]@wearehackerone.com address
Not accepted
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Missing best practices in Content Security Policy.
-
Missing email best practices (only Invalid, incomplete or missing DKIM/DMARC records)
-
Open redirect - unless an additional security impact can be demonstrated
-
Self-XSS are out of scope if could not be chained with another kind of attack that not require social engineering.
-
Account creation flows
-
Manipulation or reuse of promotional codes, vouchers, or coupons
-
Earning or spending “Zoopoints", newsletter bonuses, or referral points multiple times via timing, race conditions, or cross-shop actions.
-
Bypassing limits on loyalty programs.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://www.zoohit.cz/veterinari (out of scope)
-
Scope added
https://www.zooplus.de/tierarzt (out of scope)
-
Scope added
https://www.zooplus.es/veterinarios (out of scope)
-
Scope added
https://www.zooplus.fr/veterinaire (out of scope)
-
Scope added
https://www.zooplus.hu/allatorvos (out of scope)
-
Scope added
https://www.zooplus.it/veterinari (out of scope)
-
Scope added
https://www.zooplus.nl/dierenarts (out of scope)
-
Scope added
https://www.zooplus.pl/weterynarz (out of scope)
-
Scope added
www.bitiba.de (out of scope)
-
Scope added
www.matina-gmbh.de (out of scope)
-
Scope added
www.wolf-of-wilderness.com (out of scope)
-
Scope added
www.zoochic-eu.ru (out of scope)
-
Scope added
www.zoohit.si (out of scope)
-
Scope added
www.zoohit.sk (out of scope)
-
Scope added
www.zooplus.at (out of scope)
-
Scope added
www.zooplus.be (out of scope)
-
Scope added
www.zooplus.ch (out of scope)
-
Scope added
www.zooplus.dk (out of scope)
-
Scope added
www.zooplus.fi (out of scope)
-
Scope added
www.zooplus.gr (out of scope)
-
Scope added
www.zooplus.hr (out of scope)
-
Scope added
www.zooplus.ie (out of scope)
-
Scope added
www.zooplus.no (out of scope)
-
Scope added
www.zooplus.pt (out of scope)
-
Scope added
www.zooplus.ro (out of scope)
-
Scope added
www.zooplus.se (out of scope)
-
Scope added
zooplus.io (out of scope)
-
Scope added
www.zooplus.co.uk
-
Scope added
www.zooplus.com
-
Scope added
zooplus.net
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
#Zooplus Since 1999, zooplus has been a pioneer in pet supplies e-commerce, serving millions of pet parents with an ever-growing range of nutritional and lifestyle products, proprietary premium food and accessory brands, alongside expert advice, convenient services, and loyalty programmes. Committed to the vision of ‘Celebrating Pet Love Every Day’ and driven by a passion for innovation, zooplus aims to set the industry standard for personalised, smart shopping. Based in Munich, zooplus operates local online shops across 30 European countries.
Thank you for supporting our security mission with relentless proactivity with your reports 'We enable trust amid a hostile digital landscape.'
We look forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe!
Response Targets
Zooplus will make a best effort to meet the following SLAs for hackers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | 2 days |
| Time to Triage | 5 days |
| Time to Bounty | 14 days |
| Time to Resolution | depends on severity and complexity |
We’ll try to keep you informed about our progress throughout the process.
Disclosure Policy
- It is prohibited to discuss this program or any vulnerabilities (even resolved ones) outside of the program without explicit consent from the organization.
- Follow HackerOne's disclosure guidelines.
Program Rules
Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction or mass exfiltration of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
- Zooplus is in the EU and some services are only made available in Europe through Geo IP. To avoid problems in your test, please use a VPN with an exit node in a country in the EU.
Test Plan
- Load-intensive scans should be avoided.
- When signing up for any Zooplus account, please use your [user]@wearehackerone.com address
- Please email [email protected] to request an account if you do not have one and are unable to create one
- Make sure to include your HackerOne email address in the request
- We will try and get back to you within 5 business days
Out of scope vulnerabilities
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
- Attacks requiring MITM or physical access to a user's device.
- Previously known vulnerable libraries without a working Proof of Concept.
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Missing best practices in Content Security Policy.
- Missing email best practices (only Invalid, incomplete or missing DKIM/DMARC records)
- Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
- Open redirect - unless an additional security impact can be demonstrated
- Self-XSS are out of scope if could not be chained with another kind of attack that not require social engineering.
- Social media account takeover" findings can be only rewarded once, as the we have tens of millions of pages needing checks. We'd appreciate it if all found links to accounts are provided in one ticket.
- Only accept users leaks that include Z+ Employees or 3rd party credentials, like logistics companies. Accounts from voting pools, Kanban boards and other kind of tools used by developers under their own reason are not part of that, unless internal Z+ information is leaked thru it. We also accept leaks from Z+ customers only if comes from leaks generated IN zooplus, or other of the domains in the program, site, of course the way that this leak was obtained must be included in the report. We do not accept leaks obtained with virus, trojans, browser leaks.... directly from the customers as is not a Z+ Leak. Of course we appreciate any report of that as a good faith from all the community and we always tried to be as gratefull as company policies allowed us.
- We could not accept TLD reports that are not associated with our organization or not reserved by our business as security risk.
The following vulnerability types are out of scope for the zooplus vulnerability disclosure program. Reports that fall into these categories will not be eligible for reward or further triage:
Business Logic Vulnerabilities & Voucher, Coupon, and Discount Misuse Issues that arise from intended business processes, even if they can be abused in edge cases, are out of scope. This includes, but is not limited to:
- Account creation flows
- Manipulation or reuse of promotional codes, vouchers, or coupons
- Obtaining discounts, free gifts, or benefits (such as “Flash Deals,” “Savings Plan,” or “Zoopoints”) through business logic quirks, unless this leads to a direct compromise of core security controls or customer data.
- Exploiting regional or cross-shop promotions (e.g., using a French free shipping code for a Belgian address)
Loyalty and Points System Abuse
- Earning or spending “Zoopoints", newsletter bonuses, or referral points multiple times via timing, race conditions, or cross-shop actions.
- Bypassing limits on loyalty programs.
Contact
If you have any questions or run into blockers while testing, please email [email protected] to get in touch with our team.
Thank you for helping keep Zooplus and our users safe!