# Dyson: bug bounty program on HackerOne

> Dyson is a bug bounty program on HackerOne. Its critical reports have paid an average of $5,000 across 40 reports (HackerOne figures, November 6, 2026). It received 293 reports in the 90 days to November 6, 2026, about 2.8 per in-scope asset.

- **Company:** Dyson
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/dyson
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** July 2, 2025
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/dyson

## Payouts and volume

HackerOne's own published figures, captured November 6, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $5,000 | 40 |
| High | $1,120 | 173 |
| Medium | $500 | 238 |
| Low | $127 | 383 |

- Reports received in the last 90 days: 293 (about 2.8 per in-scope asset)
- Bounties paid in the last 90 days: $33,550
- Bounties paid in total: $486,660
- Researchers participating: 436
- First-response target: 5 days
- Triage target: 10 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 104 assets in scope (104 bounty-eligible), 32 out of scope. The policy page is the authority.

- `*.cp.dyson.com` (URL): in scope, bounty-eligible, max severity critical
- `*.dyson.com` (OTHER): in scope, bounty-eligible, max severity critical
- `Alternate Assets` (OTHER): in scope, bounty-eligible, max severity critical
- `api.dyson.at` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.be` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.ch` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.co.uk` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.com` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.de` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.dk` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.es` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.fr` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.ie` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.it` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.nl` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.no` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.pt` (URL): in scope, bounty-eligible, max severity critical
- `api.dyson.se` (URL): in scope, bounty-eligible, max severity critical
- `api.dysoncanada.ca` (URL): in scope, bounty-eligible, max severity critical
- `api.fi.dyson.com` (URL): in scope, bounty-eligible, max severity critical
- `com.dyson.mobile.android` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `Connected Products (IoT Hardware)` (OTHER): in scope, bounty-eligible, max severity critical
- `Core Assets` (OTHER): in scope, bounty-eligible, max severity critical
- `Dyson Connected Products (IoT Hardware)` (HARDWARE): in scope, bounty-eligible, max severity critical
- `dyson.at` (URL): in scope, bounty-eligible, max severity critical
- `dyson.be` (URL): in scope, bounty-eligible, max severity critical
- `dyson.ch` (URL): in scope, bounty-eligible, max severity critical
- `dyson.cn` (URL): in scope, bounty-eligible, max severity critical
- `dyson.co.jp` (URL): in scope, bounty-eligible, max severity critical
- `dyson.co.kr` (URL): in scope, bounty-eligible, max severity critical
- `dyson.co.nz` (URL): in scope, bounty-eligible, max severity critical
- `dyson.co.uk` (URL): in scope, bounty-eligible, max severity critical
- `dyson.com` (URL): in scope, bounty-eligible, max severity critical
- `dyson.com.au` (URL): in scope, bounty-eligible, max severity critical
- `dyson.com.mx` (URL): in scope, bounty-eligible, max severity critical
- `dyson.com.sg` (URL): in scope, bounty-eligible, max severity critical
- `dyson.com.tr` (URL): in scope, bounty-eligible, max severity critical
- `dyson.de` (URL): in scope, bounty-eligible, max severity critical
- `dyson.dk` (URL): in scope, bounty-eligible, max severity critical
- `dyson.es` (URL): in scope, bounty-eligible, max severity critical
- and 96 more on the BugRater page

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.