Our promise to you

• We will respond to reports in ultimately two weeks, probably faster!
• We are happy to respond to any questions, please use the button in the right top corner for this.
• We respect the safe harbour clause that you can find below

Your promise to us

• Provide detailed but to-the point reproduction steps* Include a clear attack scenario. How will this affect us exactly?
• Remember: quality over quantity!
• Please do not discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo)
• Please do not use automatic scanners -be creative and do it yourself! We cannot accept any submissions found by using automatic scanners. Scanners also won't improve your skills, and can cause a high server load (we'd like to put our time in thanking researchers rather than blocking their IP's 😉)

Conditions of participation

• SBB employees (including former employees that separated from SBB within the prior 12 months), contingent workers, contractors and their personnel, and consultants are excluded from any payment
• You may not participate in this program if you are a resident or individual located within a country appearing on any U.S. sanctions lists (such as the lists administered by the US Department of the Treasury’s OFAC).

The researcher guidelines from Intigriti apply in full with the following modifications and additions:

• SBB reserves the right to change the terms of their Bug Bounty programs at any time and reserves the right to cancel all programs at any time.
• The relationship between you and SBB is governed by and construed in accordance with the laws of Switzerland. Sole place of jurisdictions are the courts in Bern.
• You acknowledge and agree that you shall not use your relationship with SBB for any marketing or financing purpose or as reference in any personal or professional presentation, documentation or other material, or in any way utilize (neither on the Internet nor in any other way communicate to the public) any trade name, business name, logotype or trademark of SBB.

To reward your efforts we are using Intigriti's Contextual CVSS.

How do I get credentials?

For applications in our public program, we do not provide any credentials, please feel free to register yourself where possible (with your intigriti.me email address).
Exception: Existing SwissPass users may use their personal accounts on their own risks.