Booking.com
External Program
Submit bugs directly to this organization
Booking.com
External Program
Submit bugs directly to this organization
Please note when researching any vulnerability please use your @wearehackerone.com email address this will help us to know on our internal monitoring tools that its a researcher from hackerone and not a malicious actor
Booking.com is committed to working with security experts across the globe. It’s a big world and we believe that working with skilled security researchers from all corners of the globe is the key to identify the weaknesses in any technology. If you think you have found a security issue in our applications let us know via our bug-bounty program on HackerOne and we’ll work with you to fix it.
Our team of dedicated security professionals works vigilantly to help keep customer information secure. We recognize the important role that security researchers and our user community play in helping to keep Booking.com and our customers secure.
We will investigate all legitimate reports and do our best to quickly fix the problem. Before reporting though, please review this page including our Program Terms, Prohibited Actions, Reward and Payout Guidelines, Rules of Engagement, vulnerabilities and applications which are in and out of scope for rewards.
*15h November 2023 - Program went public, in a phased approach.
##Program Terms
Your participation in the Bug Bounty Program is voluntary and subject to the terms and conditions set forth on this page (“Program Terms”). By submitting a site or product vulnerability to Booking.com B.V. (“Booking.com”) you acknowledge that you have read and agreed to the program policy and guidelines.
We recognize and reward security researchers who help us keep our customer data secure by reporting vulnerabilities in our services. Monetary bounties for such reports are entirely at Booking.com’s discretion, based on risk, impact, and other factors.
If you inadvertently cause a privacy violation or disruption (such as accessing account data, service configurations, or other confidential information) while investigating an issue, you must disclose this in your report. Use test accounts when investigating issues. If you cannot reproduce an issue with a test account, you can use a real account (except for automated testing). Do not interact with other accounts without consent of the account owner.
When researching security issues, especially those which may compromise the privacy of others, you must use only test accounts in order to respect our users’ privacy. Accessing private information of other users, performing actions that may negatively affect Booking.com users (e.g., spam, denial of service) will disqualify the report. Activity that is disruptive to Booking.com operations will result in account bans and disqualification from the bounty program. Please refer to “Prohibited Actions” section in the policy.
At this time Booking.com is not permitting public disclosure of submitted reports.
##Prohibited Actions
Please do not email the program team directly. All communications regarding submissions should be done via the HackerOne platform.*
To potentially qualify for a bounty, you first need to meet the following requirements:
##Payouts
We determine bounty amounts based on a variety of factors, including (but not limited to) Impact, classification and sensitivity of the data, ease of exploit and overall risk to Booking.com customers, partners, Booking.com brand.
Quality of the report If we pay a bounty, the minimum reward is $150. Note that extremely low-risk issues may not qualify for a bounty at all. We make consistent payout amounts for similar issues, but bounty amounts and qualifying issues may change with time. Past rewards do not necessarily guarantee similar results in the future. In the event of duplicate reports, we award a bounty to the first person to submit an issue. (Booking.com determines duplicates and may not share details on the other reports.) For different attack vectors that result in the same mitigation, Booking.com reserves the right to reward the first report that is validated for that fix. All subsequent reports that are addressed by that mitigation will be considered as duplicates, regardless of the attack vector. We reserve the right to publish reports (and accompanying updates).
All determinations and decisions as to the amount of a bounty payout by Booking.com are final.
From time to time, Booking.com offers promotions in connection with the Bug Bounty Program. Reports submitted for consideration may be subject to additional governing rules for that promotion as described in those rules, which are or will be made available here (in this section).
##Scope
##In Scope Assets For in Scope Assets please refer to the Scope tab
Out-Of-Scope Applications Any application whether owned by Booking.com or third-party vendor not included as an in-scope asset will be mentioned on the scope tab as out of scope.
For Out Of Scope Assets please refer to the Scope tab
In-scope Vulnerabilities
Accepted, in-scope vulnerabilities include, but are not limited to:
Out-Of-Scope Vulnerabilities Depending on their impact, not all reported issues may qualify for a monetary reward. However, all reports are reviewed on a case-by-case basis and any report that results in a change being made will at a minimum receive recognition. Please note that our program terms and rules of engagement still apply.
The following issues are outside the scope of our vulnerability rewards program:
We believe in recognizing the work of others. If your work helps us improve the security of our service, we'll happily acknowledge your contribution.
We, of course, reserve the right to cancel or modify this program at any time. And the ultimate decision over an award --whether to give one and in what amount-- is a decision that lies entirely within our discretion.
Finally, and needless to say, please do not violate any laws when conducting your tests. Booking.com is committed to working with security experts across the globe. We believe that working with skilled security researchers from all over the world is the key to identifying the weaknesses in any technology. If you think you have found a security issue in our applications let us know via HackerOne and we’ll work with you to fix it. Please submit your finding through www.hackerone.com/disclosure-assistance for review.
Our team of dedicated security professionals works vigilantly to help keep customer information secure. We recognise the important role that security researchers and our user community play in helping to keep Booking.com and our customers secure.