Capital One Vulnerability Disclosure Program on Hackerone

{ "allows_bounty_splitting": false, "average_time_to_bounty_awarded": null, "average_time_to_first_program_response": 2, "average_time_to_report_resolved": 212, "handle": "capital-one", "id": 0, "managed_program": true, "name": "Capital One", "offers_bounties": false, "offers_swag": false, "response_efficiency_percentage": 89, "submission_state": "open", "url": "https://hackerone.com/capital-one", "website": "https://capitalone.com", "targets": { "in_scope": [ { "asset_identifier": "*.bluetarp.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.capitalone.ca", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.capitalone.co.uk", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.capitalone.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.capitaloneshopping.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.luma.co.uk", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.teamstercardnow.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.theunioncard.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.wikibuy.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "1008234539", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[CreditWise iOS](https://apps.apple.com/us/app/capital-one-creditwise/id1008234539)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "1109537081", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One Intellix® iOS](https://apps.apple.com/us/app/capital-one-intellix-mobile/id1109537081)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "1291519134", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One T&Easy iOS](https://apps.apple.com/us/app/capital-one-t-easy/id1291519134)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "1380744689", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "1450441660", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One Auto Navigator iOS](https://apps.apple.com/us/app/capital-one-auto-navigator/id1450441660)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "407558537", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One Banking iOS](https://apps.apple.com/us/app/capital-one-mobile/id407558537)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "481679012", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One UK iOS](https://apps.apple.com/gb/app/capital-one-uk/id481679012)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "808215470", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One Canada iOS](https://apps.apple.com/ca/app/capital-one-canada/id808215470\t)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "907613256", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Eno® Browser Extension", "asset_type": "OTHER", "availability_requirement": "medium", "confidentiality_requirement": "medium", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "The extension is available in the extension/add-on store of the respective browser:\n\n- [Chrome](https://chrome.google.com/webstore/detail/eno%C2%AE-from-capital-one%C2%AE/clmkdohmabikagpnhjmgacbclihgmdje?hl=en)\n- [Firefox](https://addons.mozilla.org/en-US/firefox/addon/capital-one-eno/)\n- [Edge](https://microsoftedge.microsoft.com/addons/detail/eno%C2%AE-from-capital-one%C2%AE/jkgeppojddflfhbfhjgapbcdnabegmdg)\n\nTypically, if a vulnerability exists in one of the browser extensions it will be present in the other two. In these situations it will be considered the same vulnerability and will be awarded one bounty.", "integrity_requirement": "medium", "max_severity": "critical" }, { "asset_identifier": "ca.capitalone.enterprisemobilebanking", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One Canada Android](https://play.google.com/store/apps/details?id=ca.capitalone.enterprisemobilebanking)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.capitalone.atwork", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.capitalone.credittracker", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[CreditWise Android](https://play.google.com/store/apps/details?id=com.capitalone.credittracker)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.capitalone.intellix.mobile.prod", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Intellix Android](https://play.google.com/store/apps/details?id=com.capitalone.intellix.mobile.prod)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.capitalone.tz", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One T&Easy Android](https://play.google.com/store/apps/details?id=com.capitalone.tz)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.ie.capitalone.uk", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One UK Android](https://play.google.com/store/apps/details?id=com.ie.capitalone.uk)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.konylabs.capitalone", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "[Capital One Banking Android](https://play.google.com/store/apps/details?id=com.konylabs.capitalone)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.ukcapitalone.creditWise", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" } ], "out_of_scope": [ { "asset_identifier": "*.criticalstack.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "When creating accounts on this asset, please use the following information. If you need multiple accounts, please use {username}+1@wearehackerone.com etc.\n\nEmail: \n{username}@wearehackerone.com \nFirst Name: Bug Bounty\nLast Name: Tester \nDOB: 7/27/1994\nPhone Number: 123-456-7890\nBusiness Name: Bug Bounty Program \nAddress: 1680 Capital One Drive\nState: VA\nCity: McLean \nCountry: USA", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.intelstack.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": "high", "max_severity": "none" }, { "asset_identifier": "*.unitedincome.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": "high", "max_severity": "none" }, { "asset_identifier": "414607046", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "asos-idcheck.capitalone.co.uk", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd Party Asset", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "com.yinzcam.facilities.verizon", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "idcheck.capitalone.co.uk", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd Party Asset", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "jamfproqa.capitalone.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "littlewoods-idcheck.capitalone.co.uk", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd Party Asset", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "luma-idcheck.capitalone.co.uk", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd Party Asset", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "ocean-idcheck.capitalone.co.uk", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd Party Asset", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "postoffice-idcheck.capitalone.co.uk", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd Party Asset", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "thinkmoney-idcheck.capitalone.co.uk", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd Party Asset", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "travel-qa.capitalone.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "travel.capitalone.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "very-idcheck.capitalone.co.uk", "asset_type": "URL", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "3rd Party Asset", "integrity_requirement": "none", "max_severity": "none" } ] } }

Capital One

In scope

Recent changes

Community reports

Your notes

Out of scope