Bug Bounty Programs

The AS Watson Bug Bounty Program AS Watson is a diverse family of over 130,000 people, 17,000 stores shared by 12 retail brands in 31 markets. Established in 1841, AS Watson Group is one of the world's longest-standing and most recognised retail companies with roots in Asia. For 185 years, we’ve been united by an unchanging purpose - To put a Smile on our customers’ faces today and tomorrow. It is always our pride and joy to bring a Smile to everyone we come in touch with. AS Watson Group looks forward to working with the security community to discover vulnerabilities in order to keep our businesses and customers safe. Please note that some of our websites run on a similar codebase (Hybris/SAP CMS). This means that issues that are found on one asset, might also apply to another asset (also across programs). These findings will be regarded and treated as a single issue. Our websites are always under development and have new releases on a regular basis. These new releases sometimes do introduce functionalities (and potentially new vulnerabilities). We encourage you to keep testing our assets to uncover these. This program focuses specifically on the ICI PARIS XL brand from AS Watson. This brand is operating in The Netherlands Belgium and Luxembourg.

The AS Watson Bug Bounty Program AS Watson is a diverse family of over 130,000 people, 17,000 stores shared by 12 retail brands in 31 markets. Established in 1841, AS Watson Group is one of the world's longest-standing and most recognised retail companies with roots in Asia. For 185 years, we’ve been united by an unchanging purpose - To put a Smile on our customers’ faces today and tomorrow. It is always our pride and joy to bring a Smile to everyone we come in touch with. AS Watson Group looks forward to working with the security community to discover vulnerabilities in order to keep our businesses and customers safe. Please note that some of our websites run on a similar codebase (Hybris/SAP CMS). This means that issues that are found on one asset, might also apply to another asset (also across programs). These findings will be regarded and treated as a single issue. Our websites are always under development and have new releases on a regular basis. These new releases sometimes do introduce functionalities (and potentially new vulnerabilities). We encourage you to keep testing our assets to uncover these. This program focuses specifically on the The Perfume Shop brand from AS Watson. This brand is operating in the United Kingdom.

The AS Watson Bug Bounty Program AS Watson is a diverse family of over 130,000 people, 17,000 stores shared by 12 retail brands in 31 markets. Established in 1841, AS Watson Group is one of the world's longest-standing and most recognised retail companies with roots in Asia. For 185 years, we’ve been united by an unchanging purpose - To put a Smile on our customers’ faces today and tomorrow. It is always our pride and joy to bring a Smile to everyone we come in touch with. AS Watson Group looks forward to working with the security community to discover vulnerabilities in order to keep our businesses and customers safe. Please note that some of our websites run on a similar codebase (Hybris/SAP CMS). This means that issues that are found on one asset, might also apply to another asset (also across programs). These findings will be regarded and treated as a single issue. Our websites are always under development and have new releases on a regular basis. These new releases sometimes do introduce functionalities (and potentially new vulnerabilities). We encourage you to keep testing our assets to uncover these. This program focuses specifically on the Marionnaud brand from AS Watson. This brand is operating in eight different countries within Europe.

The AS Watson Bug Bounty Program AS Watson is a diverse family of over 130,000 people, 17,000 stores shared by 12 retail brands in 31 markets. Established in 1841, AS Watson Group is one of the world's longest-standing and most recognised retail companies with roots in Asia. For 185 years, we’ve been united by an unchanging purpose - To put a Smile on our customers’ faces today and tomorrow. It is always our pride and joy to bring a Smile to everyone we come in touch with. AS Watson Group looks forward to working with the security community to discover vulnerabilities in order to keep our businesses and customers safe. Please note that some of our websites run on a similar codebase (Hybris/SAP CMS). This means that issues that are found on one asset, might also apply to another asset (also across programs). These findings will be regarded and treated as a single issue. Our websites are always under development and have new releases on a regular basis. These new releases sometimes do introduce functionalities (and potentially new vulnerabilities). We encourage you to keep testing our assets to uncover these. This program focuses specifically on the Superdrug and Savers brands from AS Watson. These brands are operating in the United Kingdom.

The AS Watson Bug Bounty Program AS Watson is a diverse family of over 130,000 people, 17,000 stores shared by 12 retail brands in 31 markets. Established in 1841, AS Watson Group is one of the world's longest-standing and most recognised retail companies with roots in Asia. For 185 years, we’ve been united by an unchanging purpose - To put a Smile on our customers’ faces today and tomorrow. It is always our pride and joy to bring a Smile to everyone we come in touch with. AS Watson Group looks forward to working with the security community to discover vulnerabilities in order to keep our businesses and customers safe. Please note that some of our websites run on a similar codebase (Hybris/SAP CMS). This means that issues that are found on one asset, might also apply to another asset (also across programs). These findings will be regarded and treated as a single issue. Our websites are always under development and have new releases on a regular basis. These new releases sometimes do introduce functionalities (and potentially new vulnerabilities). We encourage you to keep testing our assets to uncover these. This program focuses specifically on the Kruidvat and Trekpleister brands from AS Watson. These brands are operating in The Netherlands and Belgium.

The AS Watson Bug Bounty Program AS Watson is a diverse family of over 130,000 people, 17,000 stores shared by 12 retail brands in 31 markets. Established in 1841, AS Watson Group is one of the world's longest-standing and most recognised retail companies with roots in Asia. For 185 years, we’ve been united by an unchanging purpose - To put a Smile on our customers’ faces today and tomorrow. It is always our pride and joy to bring a Smile to everyone we come in touch with. AS Watson Group looks forward to working with the security community to discover vulnerabilities in order to keep our businesses and customers safe. Please note that some of our websites run on a similar codebase (Hybris/SAP CMS). This means that issues that are found on one asset, might also apply to another asset (also across programs). These findings will be regarded and treated as a single issue. Our websites are always under development and have new releases on a regular basis. These new releases sometimes do introduce functionalities (and potentially new vulnerabilities). We encourage you to keep testing our assets to uncover these. This bug bounty program focuses specifically on the Watsons brands from AS Watson. This brand has online and offline stores in many different countries in Asia and Europe. In addition, the PNS Hong Kong, Fortress Hong Kong, LookAtMe Philippines, Drogas and the Moneyback Hong Kong Loyalty program are included in the scope for this bug bounty program.

The Storebrand Vulnerability Disclosure Program (VDP) provides a clear and secure way for security researchers, customers, and partners to report potential security vulnerabilities affecting Storebrand’s digital services and systems. We encourage responsible, good-faith security research and are committed to working collaboratively with reporters to validate, triage, and remediate legitimate findings. This program outlines which assets are in scope, how vulnerabilities should be reported, and what reporters can expect from Storebrand in terms of response and handling. Storebrand is committed to coordinated vulnerability disclosure and to protecting customer data, financial information, and service availability. Reports submitted through this program will be handled confidentially and in accordance with applicable laws, regulations, and our internal security and compliance processes.

Anaconda is the trusted platform accelerating enterprise AI with governed open-source Python. We serve millions of users globally—from individual developers to Fortune 500 companies—powering AI/ML model development, data science workflows, and intelligent applications. Our platform provides pre-vetted Python packages, automated security scanning, and enterprise governance that helps organizations move from AI prototype to production faster, safer, and smarter. What do we do? We provide enterprise-ready AI development tools and trusted Python package management solutions. Anaconda Core delivers secure, validated open-source packages with intelligent dependency resolution. Anaconda AI Catalyst enables rapid deployment of pre-validated, optimized AI models with built-in governance. Our platform helps organizations scale AI initiatives while maintaining security and compliance standards. Intention for this program To collaborate with the community in identifying and addressing security vulnerabilities across Anaconda's infrastructure, products, and services. Your responsible disclosure helps us maintain the trust of millions of users who rely on our platform to advance their AI initiatives.

Welcome to Voi's Vulnerability Disclosure Program. At Voi, we’re about transforming urban transport. Since 2018, we’re on a mission to challenge the car-centric culture and bring in mobility solutions that make city life smoother, greener and more enjoyable.

Toast is the all-in-one digital technology platform built specifically for the restaurant community. We serve a diverse range of customers—from distinct local cafes to nationwide enterprise chains—powering front-of-house operations, back-of-house management, and guest-facing technology. Our platform combines powerful cloud-based software with durable hardware to help restaurants operate efficiently, delight guests, and thrive in a digital-first world. What do we do? We provide a comprehensive operating system for restaurants. The Toast platform unites Point of Sale (POS), Kitchen Display Systems (KDS), Online Ordering, and Team Management into a single, streamlined ecosystem. Beyond secure payment processing, we handle critical workflows including inventory management, payroll, loyalty programs, and third-party delivery integrations. We help restaurateurs streamline their operations, grow their business, and deliver a seamless dining experience to guests everywhere. Intention for this program To partner with the global security research community in identifying and addressing potential vulnerabilities across Toast’s hardware, software, and cloud infrastructure. Security is a priority for the Toast ecosystem given its role in daily restaurant operations. Your responsible disclosure helps us validate our defenses and ensures a reliable, secure experience for the merchants and guests who utilize our services. The targets listed below are publicly accessible, but we do not provide accounts for accessing authenticated functions. If you can create self-register for any application, feel free to do so using your Intigriti email (intigriti.me). If account creation requires a phone number, please include a reference to Intigriti in your profile, such as using 'intigriti-<name>' in the first name field or something similar.

Trusted Firmware provides a reference implementation of secure software for Arm Armv8-A, Armv9-A and Armv8-M. It provides SoC developers and OEMs with a reference trusted code base complying with the relevant Arm specifications. This Bug Bounty program rewards eligible vulnerability reports in the following Trusted Firmware projects: - Trusted Firmware-A (TF-A) - Trusted Firmware-M (TF-M) - OP-TEE - MbedTLS Note: If you like this, you may also be interested in the Arm Bug Bounty Program at https://app.intigriti.com/company/programs/arm/arm/detail.

The Ubisoft Game Security Program provides a dedicated channel for reporting security issues that affect Ubisoft video games and their related online services — including game clients, consoles, PC builds, back-end game servers, matchmaking, in‑game economies, and game‑specific APIs. This program is focused exclusively on game titles; corporate infrastructure should be reported via the Corporate Security Program. We encourage careful, good‑faith research and concise reports with reproducible steps and the minimal evidence required to show impact. Wherever possible, test on isolated environments or use disposable/test accounts — do not interfere with live matches or other players’ experiences. Extracting or exposing player personal data will not be tolerated, and do not publish findings publicly until they are remediated or approved for disclosure. Prohibited activities include social engineering, physical intrusion, creating or distributing cheats or bypasses for anti‑cheat systems, manipulating live economies to harm players, or any actions that materially disrupt gameplay or services. When reporting, provide clear reproduction steps, affected platform/version, PoC where safe, and any relevant logs or captures. Our Security team will acknowledge submissions, investigate promptly, keep reporters informed, and offer recognition consistent with program policies. To facilitate easier bug reproduction, we ask that a hash or version of the game being exploited be included in the report. Additionally, in the PoC source code, if hardcoded Virtual Addresses are used, include a comment specifying the corresponding Relative Virtual Addresses and offsets of the manipulated functions/objects. To submit a report, please use Intigriti so we can review and remediate quickly.

Liferay is a provider of B2B enterprise open source technologies that empowers businesses around the world to solve complex digital challenges. Over a thousand organizations in financial services, insurance, manufacturing, healthcare and government use Liferay worldwide. Our goal is to help companies reach their full potential to serve others, and we try to leave a positive mark on the world through our business and technology.

Exoscale is the leading Swiss/European cloud service provider. We’re a team of IT operations veterans turned cloud enthusiasts. We believe the applications of the future will be cloud native. With Exoscale we’re building infrastructure and services to help European teams build cloud native applications. This relentless focus allows us to build a cloud platform that’s both powerful and enjoyable to use. Exoscale is a trademark of Akenes SA, a private company founded in 2011 and headquartered in Switzerland. With services covering the full cloud infrastructure spectrum - from fast deploying virtual machines and S3 compatible object storage to a scalable managed Kubernetes service and databases - Exoscale provides a simple and scalable experience in order to let its clients focus on their core business.

At Bitvavo, we are committed to ensuring the security of our information, systems, and services. We recognize and value the important role of security researchers in helping us identify and mitigate cybersecurity risks. This Vulnerability Disclosure Program provides a structured and responsible way to report potential vulnerabilities, enabling us to protect our users and maintain the integrity of our platform. Before beginning your research, we kindly request that you carefully review this program's scope. This will ensure that your efforts align with our objectives. Happy hacking. Visit our website for more information: www.bitvavo.com

An open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices Hey Hackers! If you met us at DEF CON thank you for your interest in this program. This program can be used to disclose any vulnerabilities found on the devices handed out during the Con.

Dropbox invites security researchers to responsibly disclose security vulnerabilities in its services via a structured VDP. Unlike its bug bounty program, this VDP does not offer monetary rewards, though Dropbox may offer discretionary “thank you” bonuses or inclusion in a public hall of fame. The program emphasizes legal protections, timely handling of submissions, and a communication channel for responsible disclosures that are not seeking a reward.

Qualified's AI Conversational Marketing platform helps sales teams engage high-value website visitors in real-time, personalized sales conversations, right on the website. With Qualified, our customers can leverage an AI SDR (sales development representative) to ask qualification questions to website visitors, capture leads or book sales meetings; then fast-track hot prospects, open opportunities, and target accounts to live sales conversations. The result is creating more sales meetings and more pipeline. Qualified is purpose-built for companies that run on Salesforce, and is on the Salesforce AppExchange (passing the Salesforce ISV Security Review). The Qualified offering includes chat (live and AI), meetings booking, offers, email, forms, smart buttons, and signals. A 5-min product overview is available here: qualified.com/ai-sdr?play=piper-aug and a full overview of our product is available here: https://www.qualified.com/piper-demo-day# The Qualified app has two main components, widgets that run on our customer's websites and allow our customers to interact with their website visitors, and an admin console that is used to configure chatbot and AI SDR experiences, form experiences, offers, routing, etc. The admin console is also used by chat users to interact with customers on their website directly. The "widget" is the Javascript a company installs to their website. "Visitors" to the website see experiences configured by admins and can talk to reps (either live or AI) that are logged into the "console" and set to available. We've set up a test website at https://team-ojwa63madn5nq72oaosk5wi6kgg5cslcbues6dq.qualified-private-test.com/?s=0 that loads the qualified.js widget snippet for the test company. Please note, the test website itself is out of scope for the purposes of our bounty program, the widget however is in scope. The "console" is what the reps and/or the site admin login to. Available for testers at https://app.qualified-dev.com/live Our application runs on Ruby on Rails backend, postgres database, ClickHouse database, react front end utilizing graphql, rest and websockets.

Welcome to the Dropbox Bug Bounty program — where your curiosity helps keep millions of users safe. At Dropbox, we take security seriously, and we know the best defenses are built with input from the wider security community. Whether you're diving into our apps, APIs, or backend systems, your expertise plays a critical role in protecting the data people trust us with every day. We reward creativity, precision, and clear reporting — and we’re here to support you along the way. Be sure to check out our scope, rules, and submission guidelines before getting started. Let’s work together to make Dropbox even more secure — one bug at a time.

Founded in 1993, NVIDIA is the world leader in accelerated computing. Our invention of the GPU in 1999 sparked the growth of the PC gaming market, redefined computer graphics, revolutionized accelerated computing, ignited the era of modern AI, and is fueling industrial digitalization across markets. NVIDIA is now a full-stack computing infrastructure company with data-center-scale offerings that are reshaping industry.

Proof℠ is the world's first identity-assured transaction management platform. Developed by the same market leaders and experts who brought notarization online with Notarize℠, Proof offers trust in a digital world by verifying identities and securing transactions to protect your business and its customers. When risk is low and speed matters, get it signed. When the law dictates it, get it notarized. When trust matters, you need Proof. Welcome to our public vulnerability disclosure page! This program is sponsored by the Information Security team. We look forward to your submissions.

This is our public Vulnerability Disclosure Program (VDP). We invite security researchers to help us identify and remediate potential vulnerabilities on our public-facing marketing website and related infrastructure.

Welcome to the Coveo VDP Coveo uses AI-powered search and recommendations to deliver personalized experiences across websites, apps, and enterprise systems. By ingesting and analyzing data, we help organizations provide relevant content and insights to their users through our search services. Why are we of interest to a bug bounty researcher like yourself? Our platform is complex and runs a variety of interesting features. We have dozens of automated crawlers that will connect to any website/service you point them too, we allow customers to run python code directly in our infrastructure, we have 20+ years of experience in AI and are at the forefront of the latest secure GenAI deployments. If you think you can find flaws in these features or any other, welcome aboard! Additionally, reporters with high quality findings/reports will be invited into our private bug bounty program with higher rewards.

Arm is committed to security and welcomes feedback from researchers and the security community to improve its products and services. The Arm Bug Bounty Program represents a partnership between Arm and the research community. At Arm, we value collaboration with security researchers as a critical step toward enhancing the security of our products. We encourage researchers to work with us to identify, mitigate, and responsibly disclose potential security vulnerabilities. We look forward to collaborating with you! This program currently welcomes reports of vulnerabilities in certain versions of: - Firmware: Mali Command Stream Frontend (CSF) Firmware 'CSFFW' - Software: Mali GPU Kernel Driver (Kbase) By submitting your report, you agree to the terms of the Arm Bug Bounty Program. Arm reserves the right to alter the terms and conditions of this program at any time and its sole discretion.