Featured on
Featured on
— no diffs detected in snapshot history yet —
No reports yet — be the first to share your triage timing for Crypto.com.
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
{
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 125,
"average_time_to_first_program_response": 13,
"average_time_to_report_resolved": null,
"handle": "crypto",
"id": 0,
"managed_program": false,
"name": "Crypto.com",
"offers_bounties": true,
"offers_swag": true,
"response_efficiency_percentage": 100,
"submission_state": "open",
"url": "https://hackerone.com/crypto",
"website": "https://crypto.com",
"targets": {
"in_scope": [
{
"asset_identifier": "*.crypto.com",
"asset_type": "WILDCARD",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "We will consider all vulnerability reports against assets in Crypto.com's control. Severity might be limited for certain assets based on business impact.",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "*.mona.co",
"asset_type": "WILDCARD",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "We will consider all vulnerability reports against assets in Crypto.com's control. Severity might be limited for certain assets based on business impact.",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "Crypto.com Exchange APIs that require an account",
"asset_type": "API",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Includes any BFF APIs",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "Crypto.com mobile app APIs that require an account",
"asset_type": "API",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Includes any BFF APIs",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "app.mona.co",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "co.mona.android",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": "low",
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Get the app here: https://play.google.com/store/apps/details?id=co.mona.android\n\nYou won’t need test accounts for this as it will be public-facing sites for now.\n\nThe app should give you the functionality to start using CRO services.",
"integrity_requirement": null,
"max_severity": "high"
},
{
"asset_identifier": "com.monaco.mobile",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": "low",
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": null,
"max_severity": "high"
},
{
"asset_identifier": "developer-api.crypto.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "developer-platform-api.crypto.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "developer.crypto.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "experiences.crypto.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "https://crypto.com/exchange",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "https://crypto.com/nft",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Reward for GraphQL-based DOS that can cause service disruption will be capped at $500 USD",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "https://crypto.com/price",
"asset_type": "URL",
"availability_requirement": "medium",
"confidentiality_requirement": "medium",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": "medium",
"max_severity": "medium"
},
{
"asset_identifier": "https://etherscan.io/token/0xfe18ae03741a5b84e39c295ac9c856ed7991c38e",
"asset_type": "SMART_CONTRACT",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "**Bounty Range Changes: CDCETH Smart Contract**\n\nCritical Severity: Up to $50,000 USD\nExtreme Tier: Up to $1,000,000",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "https://explorer.cronos.org/token/0x2e53c5586e12a99d4CAE366E9Fc5C14fE9c6495d",
"asset_type": "SMART_CONTRACT",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "js.crypto.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "merchant.crypto.com",
"asset_type": "URL",
"availability_requirement": "low",
"confidentiality_requirement": "medium",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Reward for GraphQL-based DOS that can cause service disruption will be capped at $200 USD",
"integrity_requirement": "low",
"max_severity": "medium"
},
{
"asset_identifier": "nadex.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "For this asset, we only accept Critical and High severity issues.",
"integrity_requirement": null,
"max_severity": "medium"
},
{
"asset_identifier": "og.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "OG is available now in the U.S. via App Store, Google Play, and OG.com.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "tax.crypto.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "For this asset, we only accept Critical and High severity issues.",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "tickets.crypto.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "travel.crypto.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "web.crypto.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": null,
"max_severity": "critical"
}
],
"out_of_scope": [
{
"asset_identifier": "Crypto.com Wallet Extension",
"asset_type": "OTHER",
"availability_requirement": "low",
"confidentiality_requirement": "low",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "low",
"max_severity": "none"
},
{
"asset_identifier": "com.defi.wallet",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": "low",
"confidentiality_requirement": "medium",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "https://apps.apple.com/app/crypto-com-wallet/id1512048310",
"integrity_requirement": "low",
"max_severity": "none"
},
{
"asset_identifier": "com.defi.wallet",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": "low",
"confidentiality_requirement": "medium",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "https://play.google.com/store/apps/details?id=com.defi.wallet",
"integrity_requirement": "low",
"max_severity": "none"
},
{
"asset_identifier": "https://github.com/crypto-com/chain-desktop-wallet",
"asset_type": "SOURCE_CODE",
"availability_requirement": "low",
"confidentiality_requirement": "medium",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": "low",
"max_severity": "none"
},
{
"asset_identifier": "https://github.com/crypto-com/cro-staking",
"asset_type": "SOURCE_CODE",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "https://github.com/crypto-com/swap-contracts-core",
"asset_type": "SOURCE_CODE",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "https://github.com/crypto-com/swap-contracts-periphery",
"asset_type": "SOURCE_CODE",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
}
]
}
}app.mona.co· criticaldeveloper-api.crypto.com· criticaldeveloper-platform-api.crypto.com· criticaldeveloper.crypto.com· criticalexperiences.crypto.com· criticalcrypto.com/exchange· criticalcrypto.com/nft· criticalcrypto.com/price· mediumjs.crypto.com· criticalmerchant.crypto.com· mediumCrypto.com Exchange APIs that require an account· criticalCrypto.com mobile app APIs that require an account· criticaltickets.crypto.com· critical