{"title":"DataDome Bug Bounty","slug":"datadome-bug-bounty","rules":"# Scope\n\nThe scope of the bug bounty is :\n\n| Function | Domain |\n| --- | --- |\n| Customer Dashboard | app.datadome.co |\n| Customer Dashboard - API | api-app.datadome.co |\n| Customer API | customer-api.datadome.co |\n| Java Script | js.datadome.co |\n| Captcha | *.captcha-delivery.com |\n| Server Site API used by modules| api.datadome.co |\n| Client Side API used by JS or SDK | api-js.datadome.co |\n| Corporate Site | datadome.co or www.datadome.co |\n| Server-Side modules (in customer infrastructure) | docs.datadome.co |\n| Authentication | auth.datadome.co |\n\nYou can find all the information you need about DataDome on https:\/\/docs.datadome.co\/docs\nreadme.com third-party is out of scope\n\nauth.datadome.co is managed by Auth0 Third-Party, only DataDome direct vulnerability will be rewarded\n\nKeep in mind this is a production environment, no data alterations are allowed inside DataDome infrastructure or on DataDome customer Cloud infrastructure, and, therefore, you must not affect the availability of the platform.\n\n# Testing Policy and Responsible Disclosure:\n\nPlease adhere to the following rules while performing research on this program:\n- Denial of service (DoS) attacks on DataDome applications, servers, networks or infrastructure are strictly forbidden.\n- Avoid tests that could cause degradation or interruption of our services.\n- Do not use automated scanners or tools that generate a large amount of network traffic.\n- Only perform tests against your own accounts to protect our users' privacy.\n- Do not leak, manipulate, or destroy any user data or files in any of our applications\/servers.\n- Do not copy any files from our applications\/servers and disclose them.\n- No vulnerability disclosure, full, partial or otherwise, is allowed.\n\n\n# Proof of exploitation:\n\n- Raw HTTP requests and responses are mandatory for every report. For each step of the exploit chain, you must provide the full request and response captured via Burp Suite, OWASP ZAP, curl, or any equivalent tool. This includes the method, endpoint, relevant headers, request body, status code, and response body confirming the impact. You may redact session cookies and any data not relevant to the vulnerability. Reports missing this evidence will be triaged as \"Incomplete\" until provided.\n- Provide clear, step-by-step reproduction instructions with all necessary payloads, parameters, and commands.\n- Screenshots showing the final impact are strongly appreciated.\n- A PoC video demonstrating the full exploit chain is a welcome bonus.\n\n\n# Reward Eligibility:\n\nWe are happy to thank everyone who submits valid reports which help us improve the security of DataDome, however only those that meet the following eligibility requirements may receive a monetary reward:\n- You must be the first reporter of a vulnerability.\n- The vulnerability must be a qualifying vulnerability (see below).\n- The report must contain the following elements:\n- Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and DataDome, and remediation advice on fixing the vulnerability.\n- You must not break any of the testing policy rules listed above\n- You must not be a former or current employee of DataDome or one of its contractors.\n\n\n\n\n\n\n\nOur security team will review each committed finding and establish communication as soon as possible to reproduce and solve the reported vulnerability. Please allow 5 working days for our initial response. We ask you to make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research.","rules_html":"<h1>Scope<\/h1>\n<p>The scope of the bug bounty is :<\/p>\n<table>\n<thead>\n<tr>\n<th>Function<\/th>\n<th>Domain<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Customer Dashboard<\/td>\n<td>app.datadome.co<\/td>\n<\/tr>\n<tr>\n<td>Customer Dashboard - API<\/td>\n<td>api-app.datadome.co<\/td>\n<\/tr>\n<tr>\n<td>Customer API<\/td>\n<td>customer-api.datadome.co<\/td>\n<\/tr>\n<tr>\n<td>Java Script<\/td>\n<td>js.datadome.co<\/td>\n<\/tr>\n<tr>\n<td>Captcha<\/td>\n<td>*.captcha-delivery.com<\/td>\n<\/tr>\n<tr>\n<td>Server Site API used by modules<\/td>\n<td>api.datadome.co<\/td>\n<\/tr>\n<tr>\n<td>Client Side API used by JS or SDK<\/td>\n<td>api-js.datadome.co<\/td>\n<\/tr>\n<tr>\n<td>Corporate Site<\/td>\n<td>datadome.co or www.datadome.co<\/td>\n<\/tr>\n<tr>\n<td>Server-Side modules (in customer infrastructure)<\/td>\n<td>docs.datadome.co<\/td>\n<\/tr>\n<tr>\n<td>Authentication<\/td>\n<td>auth.datadome.co<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>You can find all the information you need about DataDome on https:\/\/docs.datadome.co\/docs<br \/>\nreadme.com third-party is out of scope<\/p>\n<p>auth.datadome.co is managed by Auth0 Third-Party, only DataDome direct vulnerability will be rewarded<\/p>\n<p>Keep in mind this is a production environment, no data alterations are allowed inside DataDome infrastructure or on DataDome customer Cloud infrastructure, and, therefore, you must not affect the availability of the platform.<\/p>\n<h1>Testing Policy and Responsible Disclosure:<\/h1>\n<p>Please adhere to the following rules while performing research on this program:<\/p>\n<ul>\n<li>Denial of service (DoS) attacks on DataDome applications, servers, networks or infrastructure are strictly forbidden.<\/li>\n<li>Avoid tests that could cause degradation or interruption of our services.<\/li>\n<li>Do not use automated scanners or tools that generate a large amount of network traffic.<\/li>\n<li>Only perform tests against your own accounts to protect our users' privacy.<\/li>\n<li>Do not leak, manipulate, or destroy any user data or files in any of our applications\/servers.<\/li>\n<li>Do not copy any files from our applications\/servers and disclose them.<\/li>\n<li>No vulnerability disclosure, full, partial or otherwise, is allowed.<\/li>\n<\/ul>\n<h1>Proof of exploitation:<\/h1>\n<ul>\n<li>Raw HTTP requests and responses are mandatory for every report. For each step of the exploit chain, you must provide the full request and response captured via Burp Suite, OWASP ZAP, curl, or any equivalent tool. This includes the method, endpoint, relevant headers, request body, status code, and response body confirming the impact. You may redact session cookies and any data not relevant to the vulnerability. Reports missing this evidence will be triaged as \"Incomplete\" until provided.<\/li>\n<li>Provide clear, step-by-step reproduction instructions with all necessary payloads, parameters, and commands.<\/li>\n<li>Screenshots showing the final impact are strongly appreciated.<\/li>\n<li>A PoC video demonstrating the full exploit chain is a welcome bonus.<\/li>\n<\/ul>\n<h1>Reward Eligibility:<\/h1>\n<p>We are happy to thank everyone who submits valid reports which help us improve the security of DataDome, however only those that meet the following eligibility requirements may receive a monetary reward:<\/p>\n<ul>\n<li>You must be the first reporter of a vulnerability.<\/li>\n<li>The vulnerability must be a qualifying vulnerability (see below).<\/li>\n<li>The report must contain the following elements:<\/li>\n<li>Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and DataDome, and remediation advice on fixing the vulnerability.<\/li>\n<li>You must not break any of the testing policy rules listed above<\/li>\n<li>You must not be a former or current employee of DataDome or one of its contractors.<\/li>\n<\/ul>\n<p>Our security team will review each committed finding and establish communication as soon as possible to reproduce and solve the reported vulnerability. Please allow 5 working days for our initial response. We ask you to make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research.<\/p>","type":"bug-bounty","status":"V","demo":false,"public":true,"bounty":true,"gift":false,"hall_of_fame":false,"hacktivity":false,"report_count_per_scope":false,"report_collaboration_active":true,"pid":null,"secured":false,"triaged":null,"disabled":false,"vdp":false,"reports_count":493,"reports_imported_count":null,"pending_hunter_suggestions_count":0,"bounty_reward_min":50,"bounty_reward_max":3000,"scopes_count":8,"archived":false,"thumbnail":{"name":"6ae061a9-bae0-44f2-b4dd-2723d003f082","original_name":"DataDome-Icon-Logo-Brand-Square-Background.png","mime_type":"image\/png","size":19483,"url":"https:\/\/cdn-yeswehack.com\/program\/thumbnail\/6ae061a9-bae0-44f2-b4dd-2723d003f082"},"event":null,"business_unit":{"name":"DataDome","slug":"datadome","description":"Online fraud & bot management for mobile apps, websites & APIs","currency":"EUR","already_activate_product":true,"logo":{"name":"f35b357d-44bf-49de-acdb-d68af627bcba","original_name":"images.jpg","mime_type":"image\/jpeg","size":4056,"url":"https:\/\/cdn-yeswehack.com\/business-unit\/logo\/f35b357d-44bf-49de-acdb-d68af627bcba"}},"vpn_outbound_ips":null,"id":null,"scopes":[{"scope":"https:\/\/app.datadome.co","scope_type":"web-application","scope_type_name":"Web application","asset_value":"CRITICAL","report_count":null},{"scope":"https:\/\/api-app.datadome.co\/","scope_type":"api","scope_type_name":"API","asset_value":"CRITICAL","report_count":null},{"scope":"https:\/\/customer-api.datadome.co","scope_type":"api","scope_type_name":"API","asset_value":"CRITICAL","report_count":null},{"scope":"https:\/\/api.datadome.co","scope_type":"api","scope_type_name":"API","asset_value":"CRITICAL","report_count":null},{"scope":"https:\/\/api-js.datadome.co","scope_type":"api","scope_type_name":"API","asset_value":"CRITICAL","report_count":null},{"scope":"https:\/\/*.captcha-delivery.com","scope_type":"web-application","scope_type_name":"Web application","asset_value":"CRITICAL","report_count":null},{"scope":"https:\/\/auth.datadome.co","scope_type":"web-application","scope_type_name":"Web application","asset_value":"CRITICAL","report_count":null},{"scope":"https:\/\/datadome.co","scope_type":"web-application","scope_type_name":"Web application","asset_value":"HIGH","report_count":null}],"out_of_scope":["All domains not listed In-Scope","Third-party widgets on www.datadome.co and app.datadome.co"],"qualifying_vulnerability":["Broken Authentication and Session Management","Cross-Site Scripting (XSS), Cross-site Request Forgery (CSRF), Server-Side Request Forgery (SSRF)","SQL Injection","Remote Code Execution (RCE)","Directory Traversal Issues \/ Local File Disclosure","Breach in the multi-tenant system (eg : Sensitive Data Exposure)","Security Misconfiguration","Missing Function Level Access Control"],"non_qualifying_vulnerability":["Any hypothetical flaw or best practices without exploitable POC","Unverified results of automated tools or scanners","Missing security-related HTTP headers which do not lead directly to a vulnerability","Mixed content warnings","Vulnerabilities that are already publicly known or variations of such","Vulnerabilities on other products or services than listed above","Issues in our DNS,  NTP or SMTP","DNS Dangling or SubDomain takeover without a real exploitable POC","Clickjacking\/UI redressing","Software version disclosure without a real exploitable POC","Stack traces or path disclosure without a real exploitable POC","Vulnerabilities affecting outdated browsers or platforms","Issues that require physical access to a victim\u2019s computer\/device","Logout and other instances of low-severity Cross-Site Request Forgery","Issues not leading to a confidentiality, traceability or integrity problem. You can report it to support@datadome.co This can help you to have a better experience and help you in your research","Bot detection capability","Brute-force attack","DataDome cookie doesn't have the secure flag","Using old TLS configuration on \"Protection API\" (needed for retro-compatibility with DataDome module installed)","Social engineering of DataDome employees and contractors","Attack against DataDome office (malware, backdoor, DoS, \u2026)","Denial of service attacks","DMARC vulnerabilities on datadome.co mail","CSV injection vulnerabilities","3rd parties security issues (Auth0, Readme.com...)"],"disclose_bounty_min_reward":null,"disclose_bounty_average_reward":null,"disclose_bounty_max_reward":null,"reward_grid_default":{"bounty_low":50,"bounty_medium":300,"bounty_high":800,"bounty_critical":2000},"reward_grid_very_low":{"bounty_low":null,"bounty_medium":null,"bounty_high":null,"bounty_critical":null},"reward_grid_low":{"bounty_low":50,"bounty_medium":300,"bounty_high":800,"bounty_critical":2000},"reward_grid_medium":{"bounty_low":50,"bounty_medium":200,"bounty_high":400,"bounty_critical":800},"reward_grid_high":{"bounty_low":50,"bounty_medium":200,"bounty_high":500,"bounty_critical":1000},"reward_grid_critical":{"bounty_low":50,"bounty_medium":300,"bounty_high":1000,"bounty_critical":3000},"tags":null,"vpn_active":false,"vpn_ips":null,"account_access":"You can get a trial account that will give you a legit access to our API by going to the address [https:\/\/datadome.co\/free-signup\/](https:\/\/datadome.co\/free-signup\/).\n\nDataDome Documentation is here: [https:\/\/docs.datadome.co\/docs\/getting-started](https:\/\/docs.datadome.co\/docs\/getting-started)\n\nYou must use your **Yeswehack alias (@yeswehack.ninja)** as an e-mail to signup.\n\nPlease put in \"Website to Protect\": **bugbounty.datadome.co**\n\nOnce the setup panel is displayed in the Dashboard, you can retrieve the **server key** and **client key** and **you must send traffic to 2 API:**\n\n\n```\ncurl 'https:\/\/api.datadome.co\/validate-request\/' --data RequestModuleName=yeswehack --data ModuleVersion=1  --data IP=0.0.0.0 --data Request=\/ --data Key=YOUR-SERVER-API-KEY\n\ncurl 'https:\/\/api-js.datadome.co\/js\/' --data-raw 'ddk=YOUR-CLIENT-KEY'\n```\n\nDoc: [https:\/\/docs.datadome.co\/reference](https:\/\/docs.datadome.co\/reference)","account_access_html":"<p>You can get a trial account that will give you a legit access to our API by going to the address <a href=\"https:\/\/datadome.co\/free-signup\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" title=\"https:\/\/datadome.co\/free-signup\/\">https:\/\/datadome.co\/free-signup\/<\/a>.<\/p>\n<p>DataDome Documentation is here: <a href=\"https:\/\/docs.datadome.co\/docs\/getting-started\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" title=\"https:\/\/docs.datadome.co\/docs\/getting-started\">https:\/\/docs.datadome.co\/docs\/getting-started<\/a><\/p>\n<p>You must use your <strong>Yeswehack alias (@yeswehack.ninja)<\/strong> as an e-mail to signup.<\/p>\n<p>Please put in \"Website to Protect\": <strong>bugbounty.datadome.co<\/strong><\/p>\n<p>Once the setup panel is displayed in the Dashboard, you can retrieve the <strong>server key<\/strong> and <strong>client key<\/strong> and <strong>you must send traffic to 2 API:<\/strong><\/p>\n<pre><code>curl 'https:\/\/api.datadome.co\/validate-request\/' --data RequestModuleName=yeswehack --data ModuleVersion=1  --data IP=0.0.0.0 --data Request=\/ --data Key=YOUR-SERVER-API-KEY\n\ncurl 'https:\/\/api-js.datadome.co\/js\/' --data-raw 'ddk=YOUR-CLIENT-KEY'<\/code><\/pre>\n<p>Doc: <a href=\"https:\/\/docs.datadome.co\/reference\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" title=\"https:\/\/docs.datadome.co\/reference\">https:\/\/docs.datadome.co\/reference<\/a><\/p>","user_agent":null,"disable_message":null,"stats":{"max_reward":null,"average_reward":null,"average_first_time_response":1,"total_reports":493,"total_reports_last24_hours":0,"total_reports_last7_days":6,"total_reports_current_month":5},"supported_languages":["GB","FR"],"report_import_nb_max":null,"report_import_line_max":null,"banner":{"name":"5075eab5-2145-4ab1-842e-8d39dddaf5f3","original_name":"DataDome-Logo-Brand-Full-Background.png","mime_type":"image\/png","size":40672,"url":"https:\/\/cdn-yeswehack.com\/program\/banner\/5075eab5-2145-4ab1-842e-8d39dddaf5f3"},"restricted_ips":null,"has_pending_version":null,"rights":["view"],"attachments":null,"hunter_message_enabled":null,"send_hunter_message_validation_required":null,"max_credential_pool_number":null,"videos_attachments_enabled":true,"sla_enabled":null,"sla_grid":null,"systemic_issue_rule_enabled":true,"systemic_issue_rule_grid":{"level1":100,"level2":100,"level3":75,"level4":50,"level5":25,"level6":10},"leakage_rule_enabled":false,"leakage_rule_grid_in_scope":{"fully_in_scope":null,"partially_in_scope":null,"out_of_scope":null},"leakage_rule_grid_out_of_scope":{"fully_in_scope":null,"partially_in_scope":null,"out_of_scope":null},"ywh_triager_user_agent":null,"report_submission_cost":2,"program_metrics":{"report_count":null,"rewards_total_amount":null,"hunter_members_count":null,"active_hunters_count":null,"launched_agentic_campaigns_count":null,"total_agentic_campaigns_count":null,"reports_in_progress_count":null,"reports_in_progress_high_critical_count":null,"reports_assessed_count":null,"reports_assessed_high_critical_count":null,"reports_accepted_count":null,"reports_accepted_high_critical_count":null,"reports_resolved_count":null,"reports_closed_count":null,"computed_at":"2026-11-05T15:22:46+01:00"},"credit_balance":null,"credit_balance_projected":null,"has_history":true,"last_update_at":"2026-03-24T12:06:08+01:00","last_program_version":null}