In brief. Dyson is a bug bounty program on HackerOne. Its critical reports have paid an average of $5,000 across 40 reports (HackerOne figures, November 6, 2026). It received 293 reports in the 90 days to November 6, 2026, about 2.8 per in-scope asset. As of Nov 6, 2026. Markdown for agents

NR Unrated

Dyson

Dyson HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at Dyson? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 6 Nov 2026.

What it pays, by severity

Critical $5,000 avg 40 reports firm

High $1,120 avg 173 reports firm

Medium $500 avg 238 reports firm

Low $127 avg 383 reports firm

$486,660 paid to researchers in total, $33,550 of it in the last 90 days. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received

293

in 90 days

Resolved

865

all time, last one yesterday

Participants

436

hunters engaged

Response efficiency

not published

HackerOne’s figure

SLA misses

targets missed

Reports received, day by day, last 29 days 266–293

9 Oct 293 reports 6 Nov

Response targets it sets itself

First response

5 days

Triage

10 days

Bounty

30 days

Resolution

90 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

Open to submit. HackerOne lists no requirements for submitting a report here.

Over 78 days (53 snapshots): intake up 15 reports; 90-day payout up $20,600.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

449 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	shubs	1,703	69 / 78 88%
2	mikee	1,496	71 / 134 53%
3	saltedfish	1,010	49 / 63 78%
4	d0xing	820	31 / 31 100%
5	fqdn	775	25 / 45 56%
6	malcolmx	683	29 / 60 48%
7	todayisnew	507	27 / 44 61%
8	hackbox-ai	501	14 / 27 52%
9	fixit	473	19 / 25 76%
10	dittyroma	464	19 / 22 86%
11	jacksparrow9999	446	20 / 30 67%
12	sergeym	433	27 / 37 73%
13	khalidamin	327	17 / 29 59%
14	me9187	300	15 / 20 75%
15	namgyukang	293	10 / 21 48%
16	samengmg	288	9 / 11 82%
17	hunter	282	6 / 7 86%
18	p4fg	262	10 / 20 50%
19	barracud4_	252	6 / 7 86%
20	x2n	248	13 / 21 62%
21	supr4s	232	10 / 28 36%
22	xavoppa	229	0 / 20 0%
23	hij4cker	224	7 / 19 37%
23	noxxxx	224	7 / 10 70%
24	nuk	139	10 / 13 77%

Showing the top 25 of 449 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 6 Nov 2026.

Dyson Ltd is a British technology company that designs and manufactures vacuum cleaners, hand dryers, bladeless fans, heaters and hair dryers.

Swag

Currency

USD

Submissions

Open

Launched

Jul 2025

Scope entries

220 HackerOne’s count

Scope

136 assets

Asset	Type	Eligibility	Max severity
*.cp.dyson.com	URL	✓ bounty	Critical
*.dyson.com	OTHER	✓ bounty	Critical
Alternate Assets	OTHER	✓ bounty	Critical
api.dyson.at	URL	✓ bounty	Critical
api.dyson.be	URL	✓ bounty	Critical

Show all 136 assets

Asset	Type	Eligibility	Max severity
api.dyson.ch	URL	✓ bounty	Critical
api.dyson.co.uk	URL	✓ bounty	Critical
api.dyson.com	URL	✓ bounty	Critical
api.dyson.de	URL	✓ bounty	Critical
api.dyson.dk	URL	✓ bounty	Critical
api.dyson.es	URL	✓ bounty	Critical
api.dyson.fr	URL	✓ bounty	Critical
api.dyson.ie	URL	✓ bounty	Critical
api.dyson.it	URL	✓ bounty	Critical
api.dyson.nl	URL	✓ bounty	Critical
api.dyson.no	URL	✓ bounty	Critical
api.dyson.pt	URL	✓ bounty	Critical
api.dyson.se	URL	✓ bounty	Critical
api.dysoncanada.ca	URL	✓ bounty	Critical
api.fi.dyson.com	URL	✓ bounty	Critical
com.dyson.mobile.android	GOOGLE PLAY APP ID	✓ bounty	Critical
Connected Products (IoT Hardware)	OTHER	✓ bounty	Critical
Core Assets	OTHER	✓ bounty	Critical
Dyson Connected Products (IoT Hardware)	HARDWARE	✓ bounty	Critical
dyson.at	URL	✓ bounty	Critical
dyson.be	URL	✓ bounty	Critical
dyson.ch	URL	✓ bounty	Critical
dyson.cn	URL	✓ bounty	Critical
dyson.co.jp	URL	✓ bounty	Critical
dyson.co.kr	URL	✓ bounty	Critical
dyson.co.nz	URL	✓ bounty	Critical
dyson.co.uk	URL	✓ bounty	Critical
dyson.com	URL	✓ bounty	Critical
dyson.com.au	URL	✓ bounty	Critical
dyson.com.mx	URL	✓ bounty	Critical
dyson.com.sg	URL	✓ bounty	Critical
dyson.com.tr	URL	✓ bounty	Critical
dyson.de	URL	✓ bounty	Critical
dyson.dk	URL	✓ bounty	Critical
dyson.es	URL	✓ bounty	Critical
dyson.fr	URL	✓ bounty	Critical
dyson.ie	URL	✓ bounty	Critical
dyson.in	URL	✓ bounty	Critical
dyson.it	URL	✓ bounty	Critical
dyson.nl	URL	✓ bounty	Critical
dyson.no	URL	✓ bounty	Critical
dyson.pl	URL	✓ bounty	Critical
dyson.pt	URL	✓ bounty	Critical
dyson.ru	URL	✓ bounty	Critical
dyson.se	URL	✓ bounty	Critical
dysoncanada.ca	URL	✓ bounty	Critical
Github findings	OTHER	✓ bounty	High
ignoreforjon.com	URL	✓ bounty	Critical
jamesdysonfoundation.com	URL	✓ bounty	High
jamesdysonfoundation.jp	URL	✓ bounty	High
Other Dyson Assets	OTHER	✓ bounty	High
Secondary Assets	OTHER	✓ bounty	Critical
shop.dyson.*	OTHER	✓ bounty	Critical
shop.dyson.co.za	URL	✓ bounty	Critical
shop.dyson.tw	URL	✓ bounty	Critical
www.dyson.*	OTHER	✓ bounty	Critical
www.dyson.ae	URL	✓ bounty	Critical
www.dyson.at	URL	✓ bounty	Critical
www.dyson.be	URL	✓ bounty	Critical
www.dyson.ch	URL	✓ bounty	Critical
www.dyson.cn	URL	✓ bounty	Critical
www.dyson.co.il	URL	✓ bounty	Critical
www.dyson.co.jp	URL	✓ bounty	Critical
www.dyson.co.kr	URL	✓ bounty	Critical
www.dyson.co.nz	URL	✓ bounty	Critical
www.dyson.co.th	URL	✓ bounty	Critical
www.dyson.co.uk	URL	✓ bounty	Critical
www.dyson.com	URL	✓ bounty	Critical
www.dyson.com.au	URL	✓ bounty	Critical
www.dyson.com.ee	URL	✓ bounty	Critical
www.dyson.com.mx	URL	✓ bounty	Critical
www.dyson.com.ro	URL	✓ bounty	Critical
www.dyson.com.sg	URL	✓ bounty	Critical
www.dyson.com.tr	URL	✓ bounty	Critical
www.dyson.com.ua	URL	✓ bounty	Critical
www.dyson.cz	URL	✓ bounty	Critical
www.dyson.d	URL	✓ bounty	Critical
www.dyson.de	URL	✓ bounty	Critical
www.dyson.dk	URL	✓ bounty	Critical
www.dyson.es	URL	✓ bounty	Critical
www.dyson.fr	URL	✓ bounty	Critical
www.dyson.hk	URL	✓ bounty	Critical
www.dyson.hu	URL	✓ bounty	Critical
www.dyson.ie	URL	✓ bounty	Critical
www.dyson.in	URL	✓ bounty	Critical
www.dyson.it	URL	✓ bounty	Critical
www.dyson.my	URL	✓ bounty	Critical
www.dyson.nl	URL	✓ bounty	Critical
www.dyson.no	URL	✓ bounty	Critical
www.dyson.pl	URL	✓ bounty	Critical
www.dyson.pt	URL	✓ bounty	Critical
www.dyson.se	URL	✓ bounty	Critical
www.dyson.tw	URL	✓ bounty	Critical
www.dyson.vn	URL	✓ bounty	Critical
www.dysoncanada.ca	URL	✓ bounty	Critical
www.fi.dyson.com	URL	✓ bounty	Critical
www.gr.dyson.com	URL	✓ bounty	Critical
www.sa.dyson.com	URL	✓ bounty	Critical
*.dynsystem.kr	WILDCARD	out	None
*central.dyson.com	URL	out	None
*dyson-demo.com	WILDCARD	out	None
30secondbleeps.com	URL	out	None
aio.shop.china-dyson.com	URL	out	None
api.q.dyson.cn	URL	out	None
auth.dysonrecall.com	URL	out	None
bounce.dyson*	URL	out	None
careers.dyson.com	URL	out	None
central-test.dyson.com	URL	out	None
centraltest.dyson.com	URL	out	None
comm.dyson*	URL	out	None
community.dyson.com	URL	out	None
dysontherapie.fr	URL	out	None
fsc.dyson.com	URL	out	None
jamesdysonfoundation.*	URL	out	None
jobs.dyson.com	URL	out	None
m.shop.dyson.cn	URL	out	None
mail.register-dyson.co.kr	URL	out	None
on.dyson.co.uk	URL	out	None
q.dyson.cn	URL	out	None
register-dyson.co.kr	URL	out	None
reviews.dyson*	URL	out	None
sakti3.com	URL	out	None
shop.dyson.co.kr	URL	out	None
shop.dyson.ru	URL	out	None
sm2.dyson.com	URL	out	None
sm3.dyson.com	URL	out	None
svn.dyson.com	URL	out	None
test.oepay.dyson.cn	URL	out	None
view.dyson.com	URL	out	None
www.dyson.ovh	URL	out	None
993135524	APPLE STORE APP ID	✓ bounty	Critical

HackerOne lists 220 scope entries. Its public listing groups many assets under one label, so we show identical entries once.