SecurityNov 3, 2026, 2:00 PM UTC·1 min read

Poland Launches National Bug Bounty With 1 Million Zloty Pool

CERT Polska has opened a national bug bounty platform with a 1 million zloty reward pool. Top-severity findings can earn up to 20,000 zloty each.

A security researcher working on a laptop with code on screen next to the Polish national flag colors. — Image: NieBezpiecznik.pl

SUMO

Dialo

ediviewer

Poland has launched a national bug bounty program that pays security researchers for finding vulnerabilities in government systems. The platform, built and run by the CERT Polska team, starts with a reward pool of 1 million zloty. A single report at the highest severity level can earn up to 20,000 zloty.

The aim, according to the organizers, is to get the community of responsible security researchers involved. Participation comes with conditions: you must be at least 18, have Polish tax residency and a PESEL number, and sign in to the platform through login.gov.pl.

Five targets at launch

The platform starts with five targets: the www.gov.pl portal, the municipality of Władysławowo, the mSzyfr messenger, CERT Polska services, and selected NASK services.

Not every bug will be rewarded. Rules, restrictions and exclusions differ from one program to the next. For CERT services, for example, 20 specific vulnerability categories are eligible, and reward ceilings are set using CVSS 4.0 scoring. A report classified as merely informational earns no payout.

Rules researchers should know

Automated tools are allowed, but the terms cap traffic at 5 requests per second. Researchers should read the rules for each target before submitting anything. Three incorrect reports, such as an unconfirmed vulnerability or one outside the defined scope, can lead to an account being blocked on the platform.

For Poland's public sector, the program gives researchers a legal and structured way to report flaws instead of leaving them to find their own route. How the 1 million zloty pool is used, and whether more targets are added, will show how far the initiative extends beyond its initial five.