N26 Bugbounty Program

Security has the highest priority at N26 and we are continuously working to provide secure products. We follow international standards as defined by leading tech companies and security communities. However, no technology is perfect, and N26 believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you find a security bug in the scope of our security program, we would really appreciate it if you would report this to us. This way, we can further improve the security and reliability of N26.

Join the program

We are running a private program on HackerOne. Anyone who has reached 18 years old or above, can request to join the program. Please be aware that only EU residents can open an account and fully use our services. We are not currently able to provide researchers with test accounts. Therefore only EU resident researchers will be able to access all the scope of the program.

Report a security bug

If you discover a security bug, please report it via the above Contact Security Team button.

Rules

We want to close all security issues, but we urge researchers and testers to stick to the scope and rules as defined here. There are many reasons for this. The primary reason is the safety of our customers. Second, we want to make you, as a researcher, aware that there are laws you must not break. Finally, it’s required to be eligible for our hall or fame or any reward. Before attempting anything please be aware that, testing our environment can be designated as a criminal act by the relevant authorities, if you are violating German law or any other law. Our rules do not supersede any applicable laws. However, we will not report you to the authorities, if you abide by the rules stated below, as long as we are not required to do so by applicable laws. We appreciate people testing our security, but N26 customers must not be affected by any research or tests. Under any circumstance, do not:

• Violate any laws (including at least German and European law and country you test from).
• Access or change accounts of other N26 customers;
• Change your own account more than necessary for the test;
• Damage or change our systems;
• Compromise the availability of our services (e.g. Denial of Service);
• Run scanning tools or test the AWS infrastructure (e.g. nessus, nikto...);
• Use any social engineering techniques to access our systems or reach to N26 employees;
• Test our partners (e.g. IDNow or TransferWise);
• Reveal any private data to third parties or to the public;
• We currently don’t allow open disclosure of reported bug, but we are actively working on it to make it a possibility.

Thank you for helping keep N26 and our users safe!