Sovcombank Offers Hackers Up to $1,500 for Each Vulnerability Found
The financial institution has launched a bug bounty program on the BI.ZONE Bug Bounty platform.
Banks operate sprawling IT infrastructures, process vast amounts of data and must keep their services running. To secure their systems, financial institutions often turn to so-called ethical hackers, who search for vulnerabilities and receive rewards for each security flaw they uncover.
Researchers Can Test 40 Targets
Sovcombank recently announced a vulnerability disclosure and bug bounty program covering its infrastructure. Security researchers participating through the BI.ZONE Bug Bounty platform can test the bank’s defenses. The program makes 40 of the bank’s digital systems and services available for testing, including web services and mobile applications.
Sovcombank has also published a list of vulnerability types eligible for rewards. These include remote code execution (RCE), SQL injection, XML External Entity (XXE) injection, local and remote file inclusion (LFI/RFI), server-side request forgery (SSRF), insecure direct object reference (IDOR) vulnerabilities, cross-site scripting (XSS) and business logic flaws.
Rewards Depend on the Vulnerability
Rewards can reach 120,000 rubles (approximately $1,500) for each vulnerability discovered. The specific payout depends on the severity of the security flaw.
Sovcombank ranks among Russia’s 10 largest banks by assets. It serves 10 million active retail customers and 300,000 businesses, making continuous improvements to the security of its digital services a priority.
“Launching the program on BI.ZONE Bug Bounty complements our existing security processes. Independent researchers can help us look at our assets from a fresh perspective and identify potential vulnerabilities. This approach allows us to improve service security proactively and strengthen customer trust,” said Andrey Kuznetsov, deputy chairman of Sovcombank’s management board.
Supplementing Existing Security Protocols
The BI.ZONE Bug Bounty program does not replace the bank’s in-house information security teams. Instead, it opens the door to a broader pool of independent researchers with a range of professional skill levels who can test the bank’s systems.
The platform has already established itself as a trusted tool for identifying vulnerabilities in partner organizations’ IT infrastructure, and demand for the service reflects that. In 2024, it hosted 34 organizations and 78 vulnerability research programs, with total payouts to researchers exceeding 60 million rubles (approximately $740,000). Banks are among its principal users.
In January 2023, Tinkoff Bank, now known as T-Bank, announced its own vulnerability research program. Security researchers from Russia and other Eurasian Economic Union (EAEU) countries were eligible to participate. It was one of the first examples of a Russian bank openly inviting ethical hackers to identify weaknesses in its systems and services.
In August 2024, Sber announced three vulnerability research programs on BI.ZONE Bug Bounty. Researchers were invited to test the bank’s official website, SberBank Online and SberInvestments. Rewards for confirmed vulnerabilities could reach 500,000 rubles (approximately $6,200).
Who Else Needs Bug Hunters?
The public sector is also turning to this model of security testing. In November 2023, Russia’s Ministry of Digital Development announced the second phase of a vulnerability research program targeting the electronic government infrastructure. In the first phase, researchers tested the security of the Gosuslugi public services portal and the Unified System of Identification and Authentication. According to BI.ZONE, more than 8,000 people took part in the initial phase. During the second phase, rewards could reach 1 million rubles (approximately $12,300) for a single report.
The use of specialized platforms to engage bug hunters is likely to expand. Vulnerability research may increasingly cover not only finished products but also software while it is still in development. However, the market’s growth will depend on whether companies are willing to fund these programs regularly, remediate vulnerabilities promptly and provide safe conditions for independent security research.
