Program Overview
Water-Link runs a bug bounty program on Intigriti with a maximum payout of $5,000. The program has 6 in-scope assets.
6
In-Scope Assets
$5,000
Max Payout
In-Scope Assets
| Asset | Type | Max Severity | Eligible |
|---|---|---|---|
| https://desktop.water-link.be/ | URL | ||
| https://pit.water-link.be/ | URL | ||
| *.water-link.be/ | WILDCARD | ||
| https://www.water-link-jaarverslag.be | URL | ||
| https://www.water-link.be | URL | ||
| https://www.waterstoring.be/ | URL |
Out-of-Scope Assets
- aquawardsspatial.water-link.be
- gisacc(*).water-link.be
- https://aquawardsoperate.water-link.be/
- https://aquawardsoperateacc.water-link.be
- https://feedback.water-link.be
- https://gis.water-link.be
- https://gis1.water-link.be
- https://gis2.water-link.be
- https://jobs.water-link.be
- https://wl_acc.water-link.be/
- https://wl_dev.water-link.be/
Tips for Hacking Water-Link
- Read the policy — Understand what's in scope, out of scope, and any specific testing restrictions before you start.
- Enumerate the attack surface — Use subdomain enumeration and directory bruteforcing to map all accessible endpoints.
- Focus on high-impact bugs — Look for SQL injection, SSRF, and IDOR vulnerabilities first.
- Test authentication flows — Check for OAuth misconfigurations and CSRF in login/signup flows.
- Write clear reports — Include steps to reproduce, impact assessment, and suggested remediation. Use Burp Suite to capture evidence.
Frequently Asked Questions
How do I start hacking Water-Link?
Sign up on Intigriti, read the program policy carefully, review the in-scope assets listed above, and start testing. Always stay within scope and follow responsible disclosure guidelines.
Does Water-Link pay bounties?
Yes, Water-Link offers monetary rewards for valid security vulnerabilities.
What types of vulnerabilities does Water-Link accept?
Water-Link accepts reports for vulnerabilities found in their 6 in-scope assets. Common accepted vulnerability types include XSS, SQL injection, SSRF, IDOR, authentication bypass, and RCE. Check the program policy for specific exclusions.