Featured on
Featured on
— no diffs detected in snapshot history yet —
No reports yet — be the first to share your triage timing for PayPal.
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
{
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 2257,
"average_time_to_first_program_response": 1,
"average_time_to_report_resolved": 4418,
"handle": "paypal",
"id": 0,
"managed_program": true,
"name": "PayPal",
"offers_bounties": true,
"offers_swag": true,
"response_efficiency_percentage": 89,
"submission_state": "open",
"url": "https://hackerone.com/paypal",
"website": "http://paypal.com/",
"targets": {
"in_scope": [
{
"asset_identifier": "*.braintree-api.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "For testing and account creation, please use *.sandbox.braintree-api.com rather than production.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.braintree.tools",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Please note, this is a development environment that is constantly in flux. Accordingly, vulnerabilities found on this asset will generally have lower impact and payouts.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.braintreegateway.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.braintreepayments.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "For testing and account creation, please use *.sand.braintreepayments.com rather than production.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.hyperwallet.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.paydiant.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "*.paylution.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.paypal.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.paypalcorp.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.venmo.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "*.xoom.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "351727428",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "[iOS Venmo App](https://apps.apple.com/us/app/venmo/id351727428)",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "Braintree SDK",
"asset_type": "OTHER",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "PayPal SDK",
"asset_type": "OTHER",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "api.loanbuilder.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "api.swiftfinancial.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "com.paypal.android.p2pmobile",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "com.paypal.merchant",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "com.paypal.merchant.client",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "com.venmo",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "com.xoom.android.app",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "com.xoom.app",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "com.yourcompany.PPClient",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": false,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "decision.swiftfinancial.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "We are aware that the root URL of this domain returns an error, the API is functioning correctly.",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "loanbuilder.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "my.loanbuilder.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "my.swiftfinancial.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "partner.swiftfinancial.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "We are aware that the root URL of this domain returns an error, the API is functioning correctly.",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "paypal.me",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "paypalobjects.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "medium"
},
{
"asset_identifier": "pigeon.swiftfinancial.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "We are aware that the root URL of this domain returns an error, the API is functioning correctly.",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "prequal.swiftfinancial.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "We are aware that the root URL of this domain returns an error, the API is functioning correctly.",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "py.pl",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "sandbox.braintreegateway.com",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "high",
"max_severity": "medium"
},
{
"asset_identifier": "scrutiny.swiftfinancial.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "We are aware that the root URL of this domain returns an error, the API is functioning correctly.",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "swiftcapital.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "swiftfinancial.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "www.loanbuilder.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "www.paypal-*.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "PayPal's Partner Sites (www.paypal-__.com) are mainly marketing based sites that are not part of the core PayPal customer domains (.paypal.com) and are managed by hosting vendor companies. They have variable timelines and are often decommissioned. A listing of these sites designated for deprecation will not be publically maintained due to frequent changes. When researching bugs on these sites, please keep this in mind as bug Submissions for sites on schedule for deprecation will not be honored.\nSubmissions of bugs relating to services or domains not referenced above or for sites on schedule for deprecation are ineligible for the Bug Bounty Program and will not be eligible for a Bounty Payment.\n",
"integrity_requirement": "not_defined",
"max_severity": "low"
},
{
"asset_identifier": "www.swiftcapital.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
},
{
"asset_identifier": "www.swiftfinancial.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "low"
}
],
"out_of_scope": [
{
"asset_identifier": "*.atlassian.net",
"asset_type": "OTHER",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "*.paypal.cn",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "**Please submit all `https://www.paypal.cn/` reports to the associated bounty program:**\n- Paypal.vulbox.com",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "braintree.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "Please note braintree.com does not belong to PayPal, and as such is out of scope. ",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "com.paypal.here",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "none"
},
{
"asset_identifier": "com.paypal.here",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": "low",
"confidentiality_requirement": "low",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "low",
"max_severity": "none"
},
{
"asset_identifier": "com.paypal.herehd",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": "low",
"confidentiality_requirement": "low",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "low",
"max_severity": "none"
},
{
"asset_identifier": "www.gopay.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "**Please submit all `Gopay` reports to:**\n- Paypal.vulbox.com\n",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "www.paypal-support.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": null,
"max_severity": "none"
}
]
}
}Braintree SDK· criticalPayPal SDK· criticalcom.paypal.android.p2pmobile· criticalcom.paypal.merchant.client· criticalcom.venmo· criticalcom.xoom.android.app· criticalscrutiny.swiftfinancial.com· lowwww.paypal-*.com· low