Cybermalveillance.gouv.fr - sensibilization, prevention and support in terms of cybersecurity
Bounty Range
$50 - $2,000
external program
Bounty Range
$50 - $2,000
external program
Cybermalveillance.gouv.fr is an initiative of the French Government, launched in 2017, to respond to the uprising number of cyber-malicious-acts in France.
Cybermalveillance.gouv.fr is offering sensibilization, prevention and support in terms of cybersecurity to French citizens.
In 2017, the Public Interest Group against cybermalveillance.gouv.fr (GIP ACYMA) was created to carry these missions.
GIP ACYMA is addressing the following type of requesters:
The website Cybermalveillance.gouv.fr is meant to be the unique and major entry point for all victims of cyber-malicious-acts. It offers advisory, prevention & sensibilization resources, and to put victims in contact with local service providers.
It is crucial for us to ensure a high level of security on our cybermalveillance.gouv.fr platform. The typical scenarios we are concerned about:
When doing your risk assessment(s), keep in mind that the Service Providers are considered ethical and engaged in the project. Furthermore, Service Provider's accounts are subject to our verification and validation.
GIP ACYMA believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our products or services, we encourage you to notify us. We welcome working with you to resolve the issue promptly.
We kindly ask you to not use collaborative tools for your research notes in order to avoid any unwanted disclosure or leak potentially exploitable by a third party.
All testings must be conducted on https://pprd.cybermalveillance.gouv.fr, please avoid interfering with production environment.
| Asset value | CVSS Low | CVSS Medium | CVSS High | CVSS Critical |
|---|---|---|---|---|
| Critical | €50 | €200 | €1,000 | €2,000 |
In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program's scope and policy.
| Scope | Type | Asset value |
|---|---|---|
| https://pprd.cybermalveillance.gouv.fr | Web application | Critical |
You can self-register as a victim.
You can also register as service provider, but these accounts are subject to admin validation. We will validate them on a regular basis, so please avoid creating several accounts for yourself as it would generate a greater workload for us and would subsequently extend our response time.
Please append to your user-agent header the following value: ' ywh-public '.
When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.
2026-02-10: We are aware of limitations in the management of UUIDs in our URLs. These exploits are not trivial and are very limited in time, in addition to requiring prior knowledge of the UUID, which is not easily guessable. In light of this and the limited information available, we consider the risk to be acceptable on our part. We have therefore decided to no longer accept reports of IDOR or improper access control on this issue.
2025-10-22: We have decided to temporarily stop accepting new reports concerning cache poisoning. As things stand, we need to work more thoroughly to address this issue.