Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 19 Sep 2026.

About EPAM EPAM's global teams serve customers in more than 35 countries across North America, Europe, Asia, and Australia. As a recognized market leader in multiple categories among top global independent research agencies, EPAM was one of only four technology companies to appear on the Forbes 25 Fastest Growing Public Tech Companies list every year of publication since 2013 and has ranked as the top IT services company on Fortune's 100 Fastest-Growing Companies list in 2019 and 2020. We value collaboration, work in partnership with our customers, and strive for the highest standards of excellence. We're remotely supporting operations for hundreds of clients worldwide in today's market conditions. No technology is perfect, and EPAM Systems believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our applications and infrastructure. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases, a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher and the opportunity to appeal and make a case for a higher priority._ Main Guidelines, read closely! ethics.epam.com is out of the program's scope. Do not perform any testing for this target! Every request must include the X-Bugcrowd header with Bugcrowd username, for e.g: Bugcrowd-<Username> Must use the Bugcrowd email alias [username]@bugcrowdninja.com. Automation against form submissions is not allowed and can lead to a ban from the program. Do not degrade EPAM's user experience, disrupt production systems, or destroy data during security testing. Please do not test requests for account removal at https://anywhere.epam.com/en/contact-us. We won't accept this as a valid submission Read the program's scope carefully! Violation of any point above will lead to an immediate program ban! Prohibited Activity Automated vulnerability scanners. We need your brainpower, not your processing power.