KO
BugcrowdOffers Rewards
Kohl's
Kohl's appears to run a bug bounty or vulnerability disclosure program on Bugcrowd. It also offers rewards for valid security reports.
Created: February 15, 2026
Last Updated: October 5, 2026
In Scope (3)
Kohl’s entire public digital footprint that is not Out-Of-Scope(See list below)
https://www.kohls.com
https://www.kohls.com/feature/app.jsp
Out of Scope (29)
apply.kohls.com
*kohls.com/kohlscredit/prequal
*kohlsecommerce.com/kohlscredit/prequal
corporate.kohls.com
productchampions.kohls.com
link-preprod.kohls.com
developer.kohls.com
lclive.kohls.com
author-mykohls.kohls.com
mykohls-origin.kohls.com
origin-stage65-corporate.kohls.com
origin-stage65-mykohls.kohls.com
author-stage65-mykohls.kohls.com
stage65-corporate.kohls.com
stage65-mykohls.kohls.com
author-qa65-mykohls.kohls.com
mykohls.kohls.com
any domain with archaius.json endoint is out of scope
*kohls.com/feature/pre-qual/prequal_inquiry.jsp?icid=prequalfooter
*kohls.com/checkout/prequal_inquiry.jsp#/preQualEligible
*kohlsecommerce.com/feature/pre-qual/prequal_inquiry.jsp?icid=prequalfooter
*kohlsecommerce.com/checkout/prequal_inquiry.jsp#/preQualEligible
vp-*.kohls.com
*qa*.kohls.com
wfh*.kohls.com
kconnect.kohls.com
connection.kohls.com
kohlsmerch.kohls.com/
http://www.b2b.kohls.com