YWH YesWeHack LIVE
OTTO.DE Bug Bounty
€50 –€2,500
Open on YesWeHack ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- managed triage
- no
10 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
https://mmp.otto.de | domain | · | · | 2026-09-20 |
https://orbidder.otto.de | domain | · | · | 2026-09-20 |
https://retail-api.otto.de | domain | · | · | 2026-09-20 |
https://supplier-connect.otto.de | domain | · | · | 2026-09-20 |
https://teleoptiprd.otto.de | domain | · | · | 2026-09-20 |
https://www.lascana.de/ | domain | · | · | 2026-09-20 |
https://www.otto.de | domain | · | · | 2026-09-20 |
https://www.otto.de/jobs | domain | · | · | 2026-09-20 |
https://apps.apple.com/de/app/otto-shopping-m%C3%B6bel/id404844644 | mobile | · | · | 2026-09-20 |
https://play.google.com/store/apps/details?id=de.cellular.ottohybrid&hl=de | mobile | · | · | 2026-09-20 |
17 out of scope — black ICE, don't touch
/apps-messenger (the chatbot in general is out of scope)other/trackingotherAll domains not listed In-ScopeotherOut-Of-Scope are also other applications hosted under the www.otto.de domain but have a different path, that is not part of our core online shop itself (you will notice, since the design of the page is completely different)otherPlease let us know if you have any questions regarding the scope.otherThose include but are not limited to (if unsure, contact us before executing the tests):otherhttps://keycloak.apps.otto.deotherhttps://www.otto.de/claraotherhttps://www.otto.de/kundenchatotherhttps://www.otto.de/newsroomotherhttps://www.otto.de/reblogotherhttps://www.otto.de/roombeezotherhttps://www.otto.de/soulfullyotherhttps://www.otto.de/twoforfashionotherhttps://www.otto.de/updatedotherhttps://www.otto.de/user/contactFormSubmitotherhttps://www.otto.de/user/sendcallbackrequestother
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.