eBay Kleinanzeigen (eBayK) is excited to be working with the hacker community in our inaugural bug bounty program. As such, we are starting small, and once we prove the value to our internal team and management, we will be expanding the program to include additional scope and increase our bounty amounts. We thank you for helping us as we ease into running a bug bounty program.
At eBay Kleinanzeigen we take user safety and the security of our services very serious. We recognize the important role that security researchers and our community play in keeping our services and users safe. We have adopted the responsible disclosure program described here to encourage everyone reporting security vulnerabilities. To recognize your efforts we offer bounty for reporting certain qualifying security vulnerabilities. Please review the following rules before you report a vulnerability. By participating in this program, you agree to be bound to these rules.
To keep our user’s data safe and our services stable please follow the following rules
...to view other users’ data
...that involves the corruption of data
...that conducts any activities that may disrupt our services.
If you think you have discovered a security vulnerability, please report it using the HackerOne reporting tool and provide the there requested information.
Please do not spam e.g. don't send additional comments just for giving us a ping and don't tag people in this organization. There is no need for that and it only creates overhead for us. We handle all incoming reports after each other, it just takes some time. Sadly, there is no way for you to fasten this process.
We are happy to thank everyone who submits valid reports which help us to improve the security of our services. However, only those that meet the following requirements may receive a bounty
Act in good faith. Our security team will assess each vulnerability report to determine if it qualifies for a bounty. A typical bounty will vary based on the probability and the damage impact of exploitation. Only one bounty per vulnerability (or with similar vulnerabilities in different areas, one bounty per type) will be rewarded.
The following security vulnerabilities are eligible for a bounty:
The following security vulnerabilities are NOT eligible for a bounty:
If you give us reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you, unless we have reason to believe that you do not act in good faith.
If users/individuals do not adhere to the above mentioned rules, we reserve the right to take appropriate (legal) measures and/or get law enforcement involved.
These Security Vulnerability Program is governed by German and European law.
If you are attempting to report spam or abuse please send an e-mail to:
Spam & Abuse - firstname.lastname@example.org
Contact us if you want more information.