Dear security researchers,
After making our bug bounty programme public, more and more submissions have been received (though some of them have been rejected): thank you for that! Now that Easter is approaching, we have a surprise for you: from today until the 22 April 2026 we will reward High, Critical and Exceptional valid findings with a 50% bonus on top of the normal bounty! Please notice that only valid reports confirmed by the Intigriti Triage team and finally accepted by Posti will grant you the additional bonus with the bounty. And as a general rule, in order to avoid that your submissions are rejected altogether, please carefully read the programme Out of scope and Rules of engagement sections. Happy hunting!
Regards,
emi
Dear security researchers,
I hope that the new year has started well for all of you! In order to make it more exciting and to give you a glimpse of what's coming next, I have the pleasure to inform you that our bug bounty programme will go public on 26 January 2026! So please keep your submissions coming and remember to follow the programme rules and updates.
Thank you for your valuable collaboration so far and keep up the excellent work!
Regards,
emi
Dear security researchers,
I am glad to inform you that some more domains have have been added to the scope of the programme:
orgadmin-ext.prd.account.posticloud.fi
id.posti.fi
mfa.posti.fi
logout.id.posti.fi
postikuori.posti.fi
Thank you for your good work so far and keep your reports coming!
Regards,
emi
Dear security researchers,
The following new domains have been added:
yritysmuutto.posti.fi
www.posti.se
developer.posti.com
Happy hunting!
Regards,
emi
Dear security researchers,
Here are some updates to the scope of the programme:
Removed domains
asiointi.netposti.fi
Changed domains
https://itella.lt replaced by https://www.smartposti.lt/
New domains
https://tuleasiakkaaksi.posti.fi
Thank you for your valuable collaboration and keep your submissions coming!
Regards,
emi
Dear security researchers,
I would like to share some updates with you. While thanking you again for your support in making Posti's services more secure, here are a few points for you to notice to make this bug bounty programme even more efficient:
Please remember to pay attention to the scope of the programme, Intigriti and Posti terms and conditions, and the rules of engagement. In there in particular, notice the Automated tooling: max. 2 requests /sec rule, therefore please make sure that your scripted / API tests are rate limited to 2 requests per second. We have had a few cases where many thousands requests were sent under 10 minutes.
In the Rules of engagement, I have added the X-Bug-Bounty-Intigriti: <username> request header. Please make sure to use it in your requests so that it will be easier to identify if they come from you in case of security incidents.
In the Rules of engagement, I have added also the User-Agent: Bug-Bounty-Intigriti - <username> user agent. Please use it in your requests whenever the previous header is not used.
In addition, a few updates on the scope of the programme:
New domain:
yrityksennoutopiste.posti.fi
Changed domains:
https://itella.ee replaced by https://www.smartposti.ee
https://itella.lv replaced by https://www.smartposti.lv
Thank you all again for your collaboration and happy hunting!Regards,
emi
Dear security researchers,
I'm glad to inform you that the following domains are now available for testing:
gateway.posti.fi
partnerselfservice.posti.fi
tnt.posti.com
posti.com
Thank you for the great work done so far and happy hunting!
Regards,
emi
Dear security researchers,
Thank you very much for the good work done so far. Your reports have kept us quite busy and it's not always possible to reply to your submissions immediately. But we try to have them reviewed as soon as we can. Thank you for your patience! Now I would like to inform you about a couple of changes to the programme:
New domain added:
elma.elma.fi
Deprecated domain replaced with a new one:
OLD: tullaus.posti.fi -> NEW: omapostitullaus.posti.fi
Thank you for your collaboration and keep up the good work!
Regards,
emi
Dear security researchers,
Thank you very much for the reports that you have been sending so far and your collaboration in making our assets more secure. I am now glad to inform you that we have added 4 new domains to the scope of the programme:
console.posti.com
developer.posti.fi
www.pakettikauppa.fi
hallinta.pakettikauppa.fi
You will find a short description in the Details section of the programme. Happy hunting and keep up the good work! Your collaboration is highly appreciated.
Regards,
emi