Sovcombank has launched a vulnerability search program on the BI.ZONE Bug Bounty platform. Independent security researchers can check more than 40 of the bank's resources — web services, mobile applications, and other systems. The reward amount depends on the criticality of the found error.
The maximum payout is 120 thousand rubles. This amount will be paid for remote code execution, SQL injections, external XML entity injection, and local and remote file inclusion. Up to 60 thousand is given for server-side request forgery, and up to 20 thousand for cross-site scripting. According to the platform, a total of 477.5 thousand rubles has been paid out, with an average payout of 25.1 thousand, and 19 reports out of 70 have been accepted.
Sovcombank has 10 million active retail clients and 300 thousand companies. The program will complement existing protection processes, the bank stated. Financial organizations remain one of the most active segments of the bug bounty market: paying a researcher is cheaper than fixing the consequences of a leak.
The rules are strict: DoS, social engineering, and testing on other people's accounts are prohibited. Traffic must go through the issued VPN with the header "X-Bug-Bounty", otherwise it will be considered an unauthorized attack.
In addition to Sovcombank, other companies in Russia are also developing bug bounty programs. HeadHunter on the Standoff Bug Bounty platform pays up to 500 thousand rubles for critical vulnerabilities, Timeweb for access to Kubernetes control nodes — up to 1 million, Avito for critical bugs, including AI services — also up to 1 million. Astra Group in most programs pays up to 100 thousand, and for vulnerabilities in Astra Linux — up to 250 thousand, Tochka Bank — up to 450 thousand. The maximum single payout in the history of Standoff Bug Bounty reached almost 4 million rubles, the average for an accepted vulnerability — about 58 thousand. In 2025, Russian organizations paid bug hunters on BI.ZONE Bug Bounty 100 million rubles for 2.5 thousand accepted reports.