NASK launches Poland's state bug bounty with 1 million zloty pool

Restrictions for researchers

Participation is not open worldwide. According to NASK, a participant must be an adult, hold a PESEL number and Polish tax residency, and provide a Polish bank account for any payout.

A platform built in-house

The most notable feature is where the reports go. NASK says Poland did not plug public bodies into an external reporting service but built its own platform, and that its operation is not outsourced. Information about discovered flaws stays in a closed loop controlled by the teams that verify and fix them, with no access for outside companies. CERT Polska head Marcin Dudek says that, to his knowledge, this is the first time a government has built its own platform for such a scheme. Other countries run government programs, he notes, but rely on external providers. NASK calls Poland one of the first countries with its own bug bounty platform for public services.

Why now

NASK points to the scale of the problem: more than 105,000 new vulnerabilities were detected worldwide between January and September 2026, against nearly 71,000 in all of 2025. The number of vulnerabilities handled by CERT Polska has risen by more than 300% in three years. NASK also names artificial intelligence as a technology speeding up both the discovery and exploitation of flaws.

NASK director Radosław Nielek stresses that no system is free of vulnerabilities, and that what matters is finding weak points and fixing them quickly. A bug bounty only helps if reports lead to fast verification and repair.