Sansec is a security research company specializing in Magento and Adobe Commerce — the team behind eComscan and some of the most publicized Magecart-related research in the industry. Their bug bounty tops out at €2^13, or €8,192, a deliberately nerdy ceiling that tells you the audience they’re courting: technical hunters who appreciate a company that runs its own direct program.
Program Overview
Sansec publishes its program at sansec.io/guides/bugs, and reports go by email to support@sansec.io. No platform, no login, no triage queue.
| Detail | Value |
|---|---|
| Reward | Up to €8,192 (2^13) |
| Policy | sansec.io/guides/bugs |
| Submission | Email: support@sansec.io |
| Type | Direct company program |
The details of severity tiers live on their policy page — read it in full before testing, because a research company’s internal bar for “valid” is likely higher than average. These people review exploits for a living; your report is being graded by experts.
Attack Surface: What Makes Sense to Test
Hunting a security vendor means your findings need to be genuinely solid. The good news: their product surface is well-defined.
- eComscan and its integrations. Sansec’s scanner is deployed inside customer stores. Anything involving how scan results, credentials, or reports flow between a merchant’s environment and Sansec’s backend is core product surface.
- The website itself. sansec.io hosts guides, tools, and research content. Client-side issues, logic bugs in any interactive tools, and authorization problems on account features are fair game per the policy.
- Any API endpoints backing their public tooling. Endpoints that process untrusted input — encoders, checkers, lookup tools — often reveal injection-class bugs.
- Browser extensions and scripts if the policy includes them. Sansec ships monitoring code that runs on thousands of stores; a flaw there has outsized impact.
Keep your scope claims honest. The policy defines what’s in and out — if you find something on an out-of-scope asset, it’s polite to report anyway but wrong to expect the top of the range.
Beginner Mistakes to Avoid
1. Underestimating the reviewers. This is the one program in this series where the triage team are published researchers. Sloppy reports, overstated impact, or recycled CVE language will get spotted instantly. Precision wins here.
2. Testing in ways that touch customer stores. If any of their infrastructure interacts with live e-commerce sites, absolutely nothing you do should affect a merchant’s operations. Destructive or noisy testing against a security company is a fast route to a legal letter.
3. Submitting scanner output. Automated scans on a security firm’s site will likely trip their monitoring before your report does. Everything here should be manual, targeted, and explained.
4. Ignoring the currency and process details. Rewards are in euros and payouts follow the process described on the policy page. Ask questions up front if anything is unclear — a short email beats an assumed payment structure.
5. Reporting low-impact findings as critical. Their ceiling implies a serious severity ladder. A missing header is not an €8,192 bug. Scope your impact claims to what you can actually demonstrate.
Why Direct Programs Like This Are Worth It
The ceiling alone (€8,192) puts Sansec above most mid-tier public programs, but the bigger factor is competition density. Platform programs on HackerOne or Bugcrowd get hundreds of duplicate submissions within hours of a scope change. A direct program like this one — published on a guide page, not shouted about — sees a fraction of that traffic.
The practical bottleneck for most hunters isn’t skill, it’s target awareness. There are dozens of direct programs with real payouts hiding on company security pages, and almost nobody systematically hunts them.
Next Step
The Web2 Bug Bounty Targets Database is a CSV/JSON dataset of 51 verified Web2 programs with reward ranges, submission contacts, and policy links — Sansec, CodeRabbit, Ably, and dozens more in one file. If you’re serious about direct-program hunting, that’s your starting grid.