Does Finnair Vulnerability Disclosure have a bug bounty program?

Finnair Vulnerability Disclosure runs a public vulnerability disclosure program (VDP) on HackerOne. It accepts good-faith security reports but does not offer cash rewards. It lists 41 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackerOne/finnair_vdp

Finnair Vulnerability Disclosure

HackerOne·updated 11h ago

vdpmanagedopen

Discord → RSS

payout: no bounty
scope: 41 in · 2 out
safe harbor: unknown
response: no reports

open program

signalsscope ×41 in 90dderived from our snapshot history

hunt score

vdpfresh

formula →

payout

0/55

bounty

0/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

41 in-scope

16urls
10wildcards
10apis
4other
1ios

Scope

In scope

041

wildcards10

+*.ifec-ground.com· critical
+*.aurinkomatkat.fiscope· critical
+*.cloud.finnair.comscope· critical
+*.dev.app.finnair.comscope· critical
+*.finnairshop.comscope· critical
+*.preprod.app.finnair.comscope· critical
+*.prod.app.finnair.comscope· critical
+*-dev.finnair.com/· critical
+*-preprod.finnair.com/· critical
+*.finnair.com/· critical

urls16

+aurinkomatkat.fi· critical
+auth.finnair.com· critical
+cargo.finnair.com· critical
+cms.finnair.com· critical
+customercare.finnair.com· critical
+easy.finnair.com· critical
+fast.finnair.com· critical
+finnair.com· critical
+finnairflightacademy.com· critical
+finnairshop.com· critical
▸▾show 6 morehide 6 more
- +partners.finnair.fi· critical
- +pay.finnair.com· critical
- +paywithpoints.finnair.com· critical
- +preauth.finnair.com· critical
- +privacy.finnair.com· critical
- +www.finnair.com· critical

apis10

+api.finnair.com/c/*· critical
+api.finnair.com/d/customer-care-api/*· critical
+api.finnair.com/d/customer/*· critical
+api-dev.finnair.com/d/*· critical
+api-preprod.finnair.com/d/*· critical
+api.finnair.com/d/fcom/*· critical
+api.finnair.com/d/loyalty-service/ *· critical
+api.finnair.com/d/mobileapp-services/*· critical
+api.finnair.com/d/mobileapp/*· critical
+api.finnair.com/d/payments/*· critical

ios01

+933867978· critical

other04

+GitHub (FinnairOyj)· critical
+157.200.0.0/16· critical
+Finnair Assets· critical
+com.finnair· critical

Out of scope

002

−3rd-party assetsother
−@finnairoyj (npmjs)other

Change history

3 events

in-scope over 70dpeak 41

first indexedscope addedscope removedreward change

2026-10-15
+ added 5 scopes
21d ago
2026-10-05
+ added 35 scopes
30d ago
2026-08-06
first indexed
90d ago · 1 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Finnair Vulnerability Disclosure.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": 0,
  "url": "https://hackerone.com/finnair_vdp",
  "name": "Finnair Vulnerability Disclosure",
  "handle": "finnair_vdp",
  "targets": {
    "in_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.aurinkomatkat.fi",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.cloud.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.dev.app.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.finnairshop.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.preprod.app.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.prod.app.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "CIDR",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "157.200.0.0/16",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "933867978",
        "eligible_for_bounty": false,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "OTHER",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "Finnair Assets",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "GitHub (FinnairOyj)",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "aurinkomatkat.fi",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "auth.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "cargo.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "cms.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "com.finnair",
        "eligible_for_bounty": false,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "customercare.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "easy.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "fast.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "finnairflightacademy.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "finnairshop.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://*-dev.finnair.com/",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://*-preprod.finnair.com/",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://*.finnair.com/",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://*.ifec-ground.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api-dev.finnair.com/d/*",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api-preprod.finnair.com/d/*",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api.finnair.com/c/*",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api.finnair.com/d/customer-care-api/*",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api.finnair.com/d/customer/*",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api.finnair.com/d/fcom/*",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api.finnair.com/d/loyalty-service/ *",
        "eligible_for_bounty": false,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api.finnair.com/d/mobileapp-services/*",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api.finnair.com/d/mobileapp/*",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "API",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://api.finnair.com/d/payments/*",
        "eligible_for_bounty": false,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": true,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "partners.finnair.fi",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "pay.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "paywithpoints.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "preauth.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "privacy.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "www.finnair.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "OTHER",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "3rd-party assets",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "OTHER",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "@finnairoyj (npmjs)",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ]
  },
  "website": "https://www.finnair.com",
  "offers_swag": false,
  "managed_program": true,
  "offers_bounties": false,
  "submission_state": "open",
  "allows_bounty_splitting": false,
  "average_time_to_bounty_awarded": null,
  "response_efficiency_percentage": 75,
  "average_time_to_report_resolved": 162,
  "average_time_to_first_program_response": 1
}