Billie
Top 1M siteHybridActiveBounty RecognitionPartial Safe Harbor
Program Details
Coordinated vulnerability disclosure policy for the German B2B buy-now-pay-later provider, framed around the EU Cyber Resilience Act. In-scope assets are listed in an appendix; rewards are discretionary, with typical examples running from EUR50 for low severity to EUR500 and up for critical.
- Allows Disclosure
- Yes
- Response SLA
- 2 business days
Rules & Testing
Excluded Methods
DosSocial EngineeringPhishingPhysical AccessAutomated Scanning
In-Scope Domains
- billie.io
- portal.billie.io
- partners.billie.io
- partners-sandbox.billie.io
- paella.billie.io
- paella-sandbox.billie.io
- fp.billie.io
- media.billie.io
- demoshop.billie.io
- bnpl.demo.billie.io
- *.bnpl.demo.billie.io
- transaction-monitoring.billie.io
- *.transaction-monitoring.billie.io
- tagging.billie.io
- debug.tagging.billie.io
- salesforce-api.billie.io
- salesforce-api-tmp.billie.io
- designated-survivor.billie.io
Out of Scope
Internal systems and employee-only environments, Development, staging, testing and sandbox systems not listed in the appendix, Third-party platforms and providers not operated by Billie, Physical infrastructure and office environments, Missing security headers, SPF, DKIM or DMARC issues, Version disclosure or banner grabbing, Low-risk clickjacking, Self-XSS, Theoretical rate-limiting observations
Legal & Standards
Standards
EU Cyber Resilience Act
Security
- PGP Key
- https://billie.io/.well-known/openpgpkey/hu/g5gwkdcmobphsnqnboxbhu1edf98x87x
- Preferred Languages
- English
security.txt
- Contact
- mailto:[email protected]
- Encryption
- https://billie.io/.well-known/openpgpkey/hu/g5gwkdcmobphsnqnboxbhu1edf98x87x
- Policy
- https://billie.io/coordinated-vulnerability-disclosure-policy
- Hiring
- https://billie.io/careers
- Languages
- en
- Expires
- Dec 31, 2026