Scope - Zooplus¶
Snapshot Date: 2025-09-01
Program Policy URL: https://hackerone.com/zooplus
Official Policy / Scope¶
Skip to main content > Learn more about HackerOne Log in Security page Program guidelines Scope Hacktivity Thanks Updates Collaborators Safe harbor Program highlights Fast Payment Ensures payment within 1 month of receiving a vulnerability report. Gold Standard Adheres to Gold Standard Safe Harbor. Platform Standards Fully compliant with Platform Standards. Managed by HackerOne Collaboration Enabled Includes Retesting 14 hours Average time to first response 3 days, 9 hours Average time to triage 7 hours Average time to bounty 3 days, 16 hours Average time from submission to bounty 3 months, 3 days Average time to resolution Rewards summary Last updated on March 6, 2023. View changes Each severity lists the 90-day average bounty and the percentage of total resolved reports, if applicable. Low
Avg. bounty $500 19.18% submissions
Medium
Avg. bounty $1,000 42.77% submissions
High
Avg. bounty $2,000 26.42% submissions
Critical
Avg. bounty $5,000 11.64% submissions
$500 $1,000 $2,000 $5,000 Our rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). Please note these are general guidelines, and reward decisions are up to the discretion of Zooplus. Scope exclusions Core Ineligible Findings are out of scope. Learn more Overview Last updated on April 1, 2025. View changes Zooplus Since 1999, zooplus has been a pioneer in pet supplies e-commerce, serving millions of pet parents with an ever-growing range of nutritional and lifestyle products, proprietary premium food and accessory brands, alongside expert advice, convenient services, and loyalty programmes. Committed to the vision of ‘Celebrating Pet Love Every Day’ and driven by a passion for innovation, zooplus aims to set the industry standard for personalised, smart shopping. Based in Munich, zooplus operates local online shops across 30 European countries. Thank you for supporting our security mission with relentless proactivity with your reports 'We enable trust amid a hostile digital landscape.' We look forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe! Response Targets Zooplus will make a best effort to meet the following SLAs for hackers participating in our program: Type of Response SLA in business days First Response 2 days Time to Triage 5 days Time to Bounty 14 days Time to Resolution depends on severity and complexity We’ll try to keep you informed about our progress throughout the process. Disclosure Policy It is prohibited to discuss this program or any vulnerabilities (even resolved ones) outside of the program without explicit consent from the organization. Follow HackerOne's disclosure guidelines. Program Rules Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward. Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact. When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced). Multiple vulnerabilities caused by one underlying issue will be awarded one bounty. Social engineering (e.g. phishing, vishing, smishing) is prohibited. Make a good faith effort to avoid privacy violations, destruction or mass exfiltration of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder. Zooplus is in the EU and some services are only made available in Europe through Geo IP. To avoid problems in your test, please use a VPN with an exit node in a country in the EU. Test Plan Load-intensive scans should be avoided. When signing up for any Zooplus account, please use your [user]@wearehackerone.com address Please email bugbounty@zooplus.com to request an account if you do not have one and are unable to create one Make sure to include your HackerOne email address in the request We will try and get back to you within 5 business days Out of scope vulnerabilities When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope: Attacks requiring MITM or physical access to a user's device. Previously known vulnerable libraries without a working Proof of Concept. Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS Missing best practices in Content Security Policy. Missing email best practices (only Invalid, incomplete or missing DKIM/DMARC records) Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis. Open redirect - unless an additional security impact can be demonstrated Self-XSS are out of scope if could not be chained with another kind of attack that not require social engineering. Social media account takeover" findings can be only rewarded once, as the we have tens of millions of pages needing checks. We'd appreciate it if all found links to accounts are provided in one ticket. Only accept users leaks that include Z+ Employees or 3rd party credentials, like logistics companies. Accounts from voting pools, Kanban boards and other kind of tools used by developers under their own reason are not part of that, unless internal Z+ information is leaked thru it. We also accept leaks from Z+ customers only if comes from leaks generated IN zooplus, or other of the domains in the program, site, of course the way that this leak was obtained must be included in the report. We do not accept leaks obtained with virus, trojans, browser leaks.... directly from the customers as is not a Z+ Leak. Of course we appreciate any report of that as a good faith from all the community and we always tried to be as gratefull as company policies allowed us. We could not accept TLD reports that are not associated with our organization or not reserved by our business as security risk. Contact If you have any questions or run into blockers while testing, please email bugbounty@zooplus.com to get in touch with our team. Thank you for helping keep Zooplus and our users safe! Top hackers See all hackers 1 yumi Reputation: 1k 2 rz01 Reputation: 1k 3 bogdantc Reputation: 842 4 nagli Reputation: 314 5 sameerphad72 Reputation: 274 6 youstin Reputation: 250 7 zeeshank Reputation: 218 8 m7moudx22 Reputation: 208 9 tefa_ Reputation: 197 10 sergioframi Reputation: 196 11 upper_anubis Reputation: 189 12 lamscun Reputation: 177 Zooplus http://zooplus.de Bug Bounty Program launched in Mar 2025 Response efficiency: 89% Submit report Rewards
Severity
Rewards
Low
Avg. bounty $500 19.18% submissions
$500 Medium
Avg. bounty $1,000 42.77% submissions
$1,000 High
Avg. bounty $2,000 26.42% submissions
$2,000 Critical
Avg. bounty $5,000 11.64% submissions
$5,000 Stats Total bounties paid $507,650 Average bounty $1,000 Top bounty range $2,000 - $5,000 Bounties paid | 90 days $33,200 Reports received | 90 days 531 Last report resolved 8 hours ago Reports resolved 325 Hackers thanked 237 Assets In Scope 4 © HackerOne Opportunities Security Leaderboard Blog Status Docs Support Disclosure Guidelines Press Privacy Terms
Parsed Scope (to fill)¶
In Scope¶
-
Out of Scope¶
-
Changes¶
- 2025-09-01: Snapshot recorded.