Banner object (1)

Hack and Take the Cash !

800 bounties in database
  Back Link to program      
Dreamland logo
Hall of Fame



The family and seasonal store has a spacious and diverse offer: from (outside) toys, multimedia and gifts about school supplies and sports accessories to children's bedrooms and decorative material. Dreamland inspires children from 0 to 14 year and their parents, family and friends and encourages them to play together.

To make it even easier for online customers Dreamland integrated in the fall of 2016 it's new webshop in his website. That makes online shopping even easier, improves online search results and provides more visitors on the site.IMPORTANT: The websites Beenhouwerij, Dreamland, Dreambaby and Collishop partially share the same codebase. They can contain common issues. If a specific issue has already been found in another one of these websites it will be treated as a duplicate for this one.

We're interested to hear about any issue that potentially compromises our company or its user's security. Before submitting a vulnerability, make sure to check that it's not listed in our out of scope policy (which you can find below). If you have additional questions about our program feel free to contact us through intigriti's support by using the button on the right-hand side (Ask scope question).

  • Duplicate reports of security issues, including security issues that have already been identified internally
  • Issues determined to be low impact may be excluded
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, may be excluded or be lowered in criticality
  • Recently disclosed zero-day vulnerabilities in commercial products where no patch or a recent patch (< 2 weeks) is available. We need time to patch our systems just like everyone else - please give us 2 weeks before reporting these types of issues.
  • Self-XSS that cannot be used to exploit other users (this includes having a user paste JavaScript into the browser console)
  • Vulnerabilities that are limited to non-current browsers (older than 3 versions) will not be accepted.
  • Login page or one of our websites over HTTP.
  • Username / email enumeration
  • CORS issues without a working PoC
  • Missing cookie flags on non-security sensitive cookies
  • Missing security headers which do not present an immediate security vulnerability
  • Cross-site Request Forgery (CSRF) with no or low impact (Logout/Logon CSRF, etc.).
  • Presence of autocomplete attribute on web forms.
  • Web content in our robots.txt file.
  • Banner Exposure / Version Disclosure
  • Discovery of any in-use service whose version contains known vulnerabilities (such as a specific version of OpenSSL, Apache, Tomcat, etc.) without a demonstration of intrusion, information retrieval, or service disruption using that vulnerability

All our rewards are impact based, therefore we kindly ask you to carefully evaluate a vulnerability's impact when picking a severity rating. To give you an idea of what kind of bugs belong in a certain severity rating we've put some examples below. Note that depending on the impact a bug can sometimes be given a higher/lower severity rating.

Exceptional (€ 5.000)

  • Remote Code Execution

Critical (€ 2.500)

  • Access to all customer personal details
  • SQL injection

High (€ 1.500)

  • Stored XSS without user interaction
  • Privilege escalation
  • Authentication bypass on critical infrastructure

Medium (€ 500)

  • XSS that requires user interaction


  • CSRF
  • Weak ciphers/certs
  • Open redirect
  • DKIM, DMARC, SPF issues

In scope

The following specific applications are in scope:


Out of scope

All subdomains are out of scope, except those mentioned explicitly above.

Guidelines * Provide detailed but to-the point reproduction steps * Include a clear attack scenario, a step by step guide in the PoC is highly appreciated * Abide with the "Colruyt Policy for investigation of security problems" set of rules. * Please do NOT discuss bugs before they are fixed (including PoC's on youtube and vimeo)

FireBounty © 2015-2019

Legal notices