The Coca-Cola Company Vulnerability Disclosure Program

Since the first Coca-Cola was served in 1886, The Coca-Cola Company has evolved into a total beverage company with over 200 brands around the world.

  • Safe harbor
Submit report

We no longer offer point rewards for submissions on this program. Please refer to our blog post: How Bugcrowd sees VDPs and points for more details.

Program stats

  • Vulnerabilities accepted 286
  • Validation within 3 days 75% of submissions are accepted or rejected within 3 days

Latest hall of famers

View all 284

Recently joined this program

575 total

Disclosure

Please note: This program or engagement does not allow disclosure. You may not release information about vulnerabilities found in this program or engagement to the public.

Welcome

Our purpose is to refresh the world and make a difference, and we can’t do that without trust. Central to maintaining this trust is the protection of the information that we’ve been entrusted with by consumers, our customers and partners, and investors. The Coca-Cola Company recognizes the positive contributions of security researchers and welcomes you to participate in our vulnerability disclosure program.

Ground Rules for Researchers

  • While use of automated scanning tools is not prohibited, our security operations team routinely blocks broad and persistent scanning activity. You should limit the scope and frequency of any scanning to prevent this, we'd suggest no more than 5 requests per second.
  • Where possible, please include UA-Bugcrowd in your request header as the User-Agent value.
  • If you create an identity/account for the purposes of testing an in-scope target, please use your @bugcrowdninja.com email address.
  • While testing DoS attacks remains out of scope based on Bugcrowd's standard program terms, we further ask that you be mindful when testing DoS-related functions such as rate limiting of user actions. If you choose to do this, please keep your requests in the dozens, not in the hundreds or thousands, while also continuing to comply with the with the requests per second rules above.
  • Please avoid techniques/PoCs that are likely to cause alarms in security monitoring such as opening shells on remote servers. Please coordinate with us in advance on these.

Scope

Program rules

This program follows Bugcrowd’s standard disclosure terms.

For any testing issues (such as broken credentials, inaccessible application, or Bugcrowd Ninja email problems), please email support@bugcrowd.com. We will address your issue as soon as possible.

Learn more about Bugcrowd’s VRT.