State bug bounty launched: up to PLN 20,000 for a vulnerability in gov.pl

NASK and CERT Polska have launched the hack.cert.pl platform with a pool of PLN 1 million in rewards for reported vulnerabilities. Reports are handled by a state team on its own infrastructure, without an external operator.

On Tuesday, November 3, NASK and the CERT Polska team operating within its structure launched the hack.cert.pl (opens in a new tab) platform. It is a bug bounty program, meaning a system of cash rewards for security researchers for detected and confirmed vulnerabilities in systems. The starting pool is PLN 1 million. A single report can earn up to PLN 20,000, depending on the severity of the flaw.

At the start, the program covers the gov.pl portal, the systems of NASK and CERT Polska, the services of the Municipality of Władysławowo, and the mSzyfr messenger. Each of the five competitions has its own rules covering the scope of testing, conditions, and reward rates. Testing other public systems is not included in the invitation. According to NASK director Radosław Nielek, quoted by “Rzeczpospolita,” if the model proves successful, the program will be gradually extended to additional local and central government administration units.

Adults with a PESEL number, Polish tax residency, and a Polish bank account can take part. Identity is confirmed through the government service Login.gov.pl. As the Zaufana Trzecia Strona service explains, the competition formula makes it possible to legally pay rewards to individuals, while a series of incorrect reports may result in a temporary account suspension.

Government bug bounty programs operate in other countries, but usually through external operators. The U.S. Department of Defense launched the first such program, “Hack the Pentagon,” in 2016 with HackerOne. CERT Polska head Marcin Dudek emphasizes that the Polish platform operates entirely on state infrastructure, and information about vulnerabilities does not go to external companies. NASK justifies the program’s launch by the scale of the problem: from January to September 2026, more than 105,000 new vulnerabilities were detected worldwide, compared with nearly 71,000 in all of 2025. The number of vulnerabilities handled by CERT Polska has increased by more than 300 percent over three years.

A mechanism that private companies have been using for years is now reaching the Polish administration. For public sector software providers, this means that systems included in the program will be checked by independent researchers, and reports will go to CERT Polska.