Does Circle have a bug bounty program?

Yes, Circle runs a public bug bounty program on HackerOne. It currently lists 22 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackerOne/circle-bbp

Circle

HackerOne·updated 6h ago

bountymanagedopen

Discord → RSS

payout: no bounty
scope: 22 in · 0 out
safe harbor: unknown
response: no reports

open program

signalsscope ×0.8 in 90dderived from our snapshot history

hunt score

cashfresh

formula →

payout

0/55

bounty

20/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

22 in-scope

12contracts
6source
4urls

Scope

In scope

022

urls04

+api.circle.com· critical
+app.circle.com· critical
+console.circle.com· critical
+github.com/circlefin/stellar-cctp· critical

source code06

+github.com/circlefin/aptos-cctp· critical
+github.com/circlefin/stablecoin-aptos· critical
+github.com/circlefin/stablecoin-starknet· critical
+github.com/circlefin/stablecoin-sui· critical
+github.com/circlefin/stablecoin-xlm· critical
+github.com/circlefin/sui-cctp· critical

smart contracts12

+github.com/circlefin/noble-cctp· critical
+github.com/circlefin/buidl-wallet-contracts· critical
+github.com/circlefin/evm-cctp-contracts· critical
+github.com/circlefin/evm-cpn-contracts· critical
+github.com/circlefin/evm-gateway-contracts· critical
+github.com/circlefin/evm-xreserve-contracts· critical
+github.com/circlefin/noble-fiattokenfactory· critical
+github.com/circlefin/solana-cctp-contracts· critical
+github.com/circlefin/solana-gateway-contracts· critical
+github.com/circlefin/stablecoin-evm· critical
▸▾show 2 morehide 2 more
- +github.com/circlefin/stablecoin-near· critical
- +github.com/circlefin/starknet-cctp· critical

Out of scope

000

none listed

Change history

3 events

in-scope over 56dpeak 29

first indexedscope addedscope removedreward change

2026-10-01
− removed 5 scopes
36d ago
2026-09-12
− removed 2 scopes · rpc.blockdaemon.testnet.arc.network, rpc.quicknode.testnet.arc.network
55d ago
2026-08-06
first indexed
92d ago · 29 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Circle.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": 0,
  "url": "https://hackerone.com/circle-bbp",
  "name": "Circle",
  "handle": "circle-bbp",
  "targets": {
    "in_scope": [
      {
        "asset_type": "URL",
        "instruction": "Testing should be done on api-sandbox.circle.com.",
        "max_severity": "critical",
        "asset_identifier": "api.circle.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Testing should be done on app-sandbox.circle.com.",
        "max_severity": "critical",
        "asset_identifier": "app.circle.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the web2 portion of console.circle.com is in scope. Anything smart contract/smart contract platform or otherwise web3 related is not in scope. \n\nResearchers should make it clear they're HackerOne researchers in their username and email domain, and must be using testnet. ",
        "max_severity": "critical",
        "asset_identifier": "console.circle.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "http://github.com/circlefin/noble-cctp",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/aptos-cctp",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/buidl-wallet-contracts",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/evm-cctp-contracts",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/evm-cpn-contracts",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/evm-gateway-contracts",
        "eligible_for_bounty": true,
        "integrity_requirement": "medium",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "medium"
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/evm-xreserve-contracts",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/noble-fiattokenfactory",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/solana-cctp-contracts",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/solana-gateway-contracts",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/stablecoin-aptos",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/stablecoin-evm",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/stablecoin-near",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/stablecoin-starknet",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/stablecoin-sui",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/stablecoin-xlm",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SMART_CONTRACT",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/starknet-cctp",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/stellar-cctp",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://github.com/circlefin/sui-cctp",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": []
  },
  "website": "https://www.circle.com/",
  "offers_swag": false,
  "managed_program": true,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 2542,
  "response_efficiency_percentage": 90,
  "average_time_to_report_resolved": 3178,
  "average_time_to_first_program_response": 10
}