Bug Bounty Switzerland Vulnerability Disclosure Policy


Bug Bounty Switzerland acknowledges the valuable role of independent security researchers acting in good faith to help maintain the safety and security of our and our customers’ data and the reliability of our products and services. We therefore welcome responsible reporting of any vulnerabilities identified in digital assets owned, operated or maintained by us. 

This policy outlines the steps for reporting vulnerabilities to us. Please review the policy carefully before you test and/or report a vulnerability. We are committed to collaborate with security researchers to verify and address any potential vulnerabilities that will be reported. 


Any public-facing digital asset owned, operated, or maintained by Bug Bounty Switzerland. 

Out of Scope 

Please note that we use services from other companies for some parts of our systems and infrastructure. Vulnerabilities discovered or suspected in those systems should be reported to the appropriate vendor or applicable authority.  

Our Commitment 

When working with us, according to this policy, you can expect us to: 

Our Expectations 

In participating in our vulnerability disclosure program, we ask you to: 

Bug Bounty Switzerland does not permit the following types of security research: 

While we encourage you to report to us any vulnerabilities you find, the following conduct however is prohibited: 

Vulnerability Disclosure 

We value the effort of external security researchers who identify security vulnerabilities and disclose those vulnerabilities responsibly so that they can be fixed. Our policy is to allow publication, provided the following conditions are met (Coordinated Vulnerability Disclosure):  

Official Channels 

Please report security issues via security@bugbounty.ch, providing all relevant information. Do not submit reports from automated tools without verifying them. The more of the following details you provide, the easier it will be for us to triage and fix the issue: 

We support encrypted messages via PGP/GNU Privacy Guard (GPG). Our public key is available at the following link: https://www.bugbounty.ch/pgp-key.txt  

Please note that these channels are for reporting undisclosed security vulnerabilities only and must not be used for any other support or information requests. Emails sent to this address that does not relate to undisclosed security vulnerabilities will not receive any response.  

Safe Harbor 

You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before you continue your research. 

Note that the Safe Harbor applies only to legal claims under the control of the organization participating in this policy, and that the policy does not bind independent third parties.