Red Bull appreciates the work of security researchers to make the internet a better - and more secure - place. Even though we aim to prevent security issues by applying state-of-the art development and operations processes, systems and technical services outside our direct control might have vulnerabilities and weaknesses and we aim to identify and address those before any negative impact occurs. As appreciation we have a unique reward system in place, please see FAQ for more information.
This is a responsible disclosure program without bounties.
Domains that are related to Red Bull and can be found on this list.
Any subdomain not mentioned in this list, will be considered as out of scope.
We are happy to give a wide scope for the researchers. See the in scope domains in the section above. The out of scope list can be found below.
As a general rule of thumb, severity assessments will be based upon their respective CVSS v3 score, with the factors below taken into account to raise or lower the final severity score: https://app.intigriti.com/programs/redbull/redbull/detail
We keep up the right to change the severity rating based on our internal assessments of criticality.
Please be aware that Exceptional ratings only apply for Remote Code Execution on assets tied to our business critical core infrastructure - there are several intependend networks with different criticalities and known risks in place - some of them do have more vulnerable assets deployed by our knowledge where RCE is no surprise and therefore are isolated in these "silos".
Yes, we do appreciate the time and effort of each individual researchers and even though we do not give out monetary reward we are happy to award some "Care Package" based on the severity of the reported finding.
Sure, please find more information below.
We do shipment of reward(s) based on the details submitted via form you receive after your finding is accepted by our team.
Yes, but please do not discuss and/or submit any query regarding your submission. We keep up this channel solely for questions regarding reward.
Contact:
hackersrewardsupport@redbull.com
We will try to do our best, to get back to you as soon as possible based on our availability.
Please note that we do not reward any submissions that aren't received through our trusted partner Intigriti.
Certainly, we promote collaboration! However, keep in mind that the value of the reward may be split among group that collaborated on the finding. Otherwise, the author of submission receives the whole reward.
Due to restrictions in particular regions we may not have a distribution partners in some countries therefore we cannot guarantee a reward delivery to these countries(List may extend or shrink after some period of time):
Researchers in India receive their rewards on a quarterly basis
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.
