Dossier Medical Partagé Bug Bounty Program
Caisse Nationale de l'Assurance maladie · YesWeHack · launch date not exposed by platform
Medium competitionWebApi
Government — live program on YesWeHack.
Metrics
Bounty range$50 – $2.0k
Paid this month$0
Reports11/mo
Hunters0
Beginner fit
77/100
This program gets very few competing reports.
Time to triage1d
Time to first bounty21d
Engage
Open on YesWeHackAlways read the full policy on the platform before submitting. Scope below is a summary only.
Scope assets10
Bounty floor$50
In-scope assets
- https://www.dmp.fr
- https://www.dmp.gouv.fr
- api.dmp.gouv.fr
- auth.dmp.gouv.fr
- wps-cps.dmp.gouv.fr
- wps-cps.cv.dmp.gouv.fr
- web-mh.dmp.gouv.fr
- lps.dmp.gouv.fr
- lps2.dmp.gouv.fr
- https://sip2.dmp.gouv.fr
Fetched live from the YesWeHack API.
Wanted categories
General
Who should hunt here
Beginners
Workable- Wide attack surface — 10 assets means overlooked corners (old subdomains, staging hosts) are statistically likely.
- Fast feedback — triage lands in ~1 day, so you learn what this team pays for quickly.
- Low entry point — the bounty floor starts at $50, so lower-severity findings are still worth submitting.
Intermediate
Good target- Real ceilings — payouts reach $2.0k, so chaining two medium findings into one report actually pays.
- APIs are in scope — where medium hunters get paid: broken object-level authorization, mass assignment, and rate-limit gaps.
- Active program — ~11 valid reports/month means the triage queue is alive and templates are established.
- Moderate crowding: enough competition that obvious finds go fast, but systematic work on less-visited assets still pays.
Pros
High value- 10 assets scale well with automation — attack-surface monitoring and diffing pay off at this size.
Think twice if
- Program age is unknown — YesWeHack doesn't expose start dates, so "freshness" can't be verified.
Where these numbers come from
Live from YesWeHack
- Bounty range, total report count & average first-response time — live YesWeHack API
- Full in-scope target list — fetched live from the YesWeHack program detail
Modeled estimates
- Payout speed — modeled default; the API doesn't expose time-to-bounty
- Beginner fit — computed from the signals above (methodology on this page)
Recon launchpad
One-click starting points per asset — certificate history, archived pages, leaked code, and exposed hosts. Open results in their own tabs.
yeswehack.com