ADAC Vulnerability Disclosure Program

{
  "id": "a80f638a-58a5-4f1c-a427-9d944cabd51a",
  "name": "ADAC Vulnerability Disclosure Program",
  "company_handle": "adac",
  "handle": "adacvulnerabilitydisclosureprogram",
  "url": "https://www.intigriti.com/programs/adac/adacvulnerabilitydisclosureprogram/detail",
  "status": "open",
  "confidentiality_level": "public",
  "tacRequired": false,
  "twoFactorRequired": false,
  "min_bounty": {
    "value": 0,
    "currency": "EUR"
  },
  "max_bounty": {
    "value": 0,
    "currency": "EUR"
  },
  "targets": {
    "in_scope": [
      {
        "type": "url",
        "endpoint": "all",
        "description": "The scope of this Vulnerability Disclosure Program includes all digital services of ADAC e.V., ADAC SE, and ADAC Stiftung, including their majority-owned subsidiaries and affiliated companies. Third-party systems and services that are not majority-owned or operated by ADAC are excluded unless explicitly listed as in scope. \n\n**The following third parties are definied out of scope:**\n* Allianz\n* Bank 11\n* Solaris\n* meinauto.de\n* ADAC Fahrsicherheitszentren\n* ADAC Regionalclubs\n\n\n**Out of Scope – Assets Covered by the Private Bug Bounty Program**\nThe following assets are covered by ADAC's private Bug Bounty Program and are therefore out of scope for this Vulnerability Disclosure Program:\n* ahp.adac.de\n* login.adac.de\n* https://www.adac.de/mein-adac\n* https://www.adac.de/mein-adac/meine-persoenlichen-daten/notfallpass/infoseite/\n* https://www.adac.de/services/pannenhilfe/pannenhilfe-online\n* autovermietung.adac.de\n* pincamp.com\n* sndpartner.adac.de\n* schluessel.adac.de\n* https://play.google.com/store/apps/details?id=de.adac.mobile.pannenhilfe&hl=de&pli=1\n* https://apps.apple.com/de/app/adac-pannenhilfe/id406968474\n* bewerbung.adac.de\n* mft.adac.de\n* myit.adac.de\n* www.adac-intranet.de\n* https://portal.stiftung.adac.de/de/user/login\n* adac.de\n* *.adac.de\n* *.adac-motorsport.de\n* adac-ehrenamt.de\n\nNote: Vulnerabilities affecting any of the above assets should be submitted through the dedicated ADAC Private Bug Bounty Program and not through this Vulnerability Disclosure Program.",
        "impact": "No Bounty"
      },
      {
        "type": "iprange",
        "endpoint": "193.30.38.0/24",
        "description": null,
        "impact": "No Bounty"
      },
      {
        "type": "iprange",
        "endpoint": "193.30.37.0/24",
        "description": null,
        "impact": "No Bounty"
      },
      {
        "type": "iprange",
        "endpoint": "193.30.36.0/24",
        "description": null,
        "impact": "No Bounty"
      }
    ],
    "out_of_scope": []
  }
}