Poland launches million PLN bug bounty program for public systems

CERT Polska, operating within NASK, has launched a national bug bounty program to enhance the cybersecurity of Polish public administration systems. The initiative features a total prize pool of one million PLN, with individual rewards for confirmed vulnerabilities reaching up to 20,000 PLN.

The program, which debuted on November 3, 2026, utilizes a custom-built domestic platform, hack.cert.pl, to ensure all data remains within controlled national infrastructure without the use of external commercial operators. The initial phase includes five specific programs covering the GOV.PL portal, the mSzyfr messenger, the systems of the Władysławowo municipality, and the internal systems of CERT Polska and NASK.

To participate, researchers must be adults with a Polish tax residency, a PESEL number, and a Polish bank account. Organizers have indicated plans to eventually allow minors aged 16 to 18 to participate with parental consent. The initiative aims to leverage the expertise of ethical hackers to identify and patch security flaws before they can be exploited by cybercriminals.