The following systems are included in Deutsche Telekom's bug bounty program (T Mobile US runs a separate bug bounty program on Bugcrowd)
The following information from your analysis is especially important for your report:
We evaluate each reported vulnerability individually. If we need additional information from your analysis, we will contact you. After the evaluation is complete, we determine the reward we will pay for your work. The following principles apply:
The stated rewards are based on a specific risk. For each reported vulnerability, we assess the risk individually, which determines how much reward we pay.
To assess a vulnerability’s severity, we use Bugcrowd’s Vulnerability Rating Taxonomy or, alternatively, the Common Vulnerability Scoring System (CVSS) in Version 4.0.
As you can see, we have defined different categories. Each category differs in terms of vulnerability severity and the selection of targets. The reward amount for each category is largely determined by severity. It is based on a specific risk, which consists of the likelihood of occurrence and the extent of damage. For each reported vulnerability, we assess the risk individually. If there are significant deviations, we may reduce or increase the individual reward. If a reported vulnerability affects multiple systems, we pay the reward only once.
We do not pay rewards for vulnerabilities in customer systems, third-party software, and services.
We require responsible disclosure. If you discover a vulnerability, please report it to us promptly. We will investigate the vulnerability and do our best to resolve it as quickly as possible. If you would like to publish details of your finding, please contact us first and wait for the appropriate approval.
During your testing, handle the service under review with care and do not limit its availability. Do not access, modify, download, delete, or disclose any data. If you violate these rules, we are legally required to report this to the authorities. Neither you nor we want that. If you are unsure, please contact our Bug Bounty team.
Deutsche Telekom's Bug Bounty Program is open to everyone.
Everyone is eligible to participate except current and former employees of Deutsche Telekom AG and its affiliated companies, as well as their relatives or legal representatives. Minors need written consent from a parent or legal guardian.
| RoE Do's | RoE Don'ts |
|---|---|
|
|
|
|
|
|
|
|
|
|
| |
|
Communication and collaboration are key to the success of the bug bounty program. Please keep us regularly updated on the progress of your research and share all relevant information with us promptly. We value open and transparent communication and strive to provide the same.
