Monzo Public Bug Bounty Program

{
  "id": "23f5d877-7948-4740-830c-393e66753fc4",
  "name": "Monzo Public Bug Bounty Program",
  "company_handle": "monzobank",
  "handle": "monzopublicbugbountyprogram",
  "url": "https://www.intigriti.com/programs/monzobank/monzopublicbugbountyprogram/detail",
  "status": "open",
  "confidentiality_level": "public",
  "tacRequired": false,
  "twoFactorRequired": false,
  "min_bounty": {
    "value": 50,
    "currency": "GBP"
  },
  "max_bounty": {
    "value": 12500,
    "currency": "GBP"
  },
  "targets": {
    "in_scope": [
      {
        "type": "wildcard",
        "endpoint": "*.monzo.com",
        "description": "The crux of Monzo where the APIs live as well as Monzo Business. Excludes the main website (like `monzo.com`/`www.monzo.com`).",
        "impact": "Tier 1"
      },
      {
        "type": "wildcard",
        "endpoint": "*.prod-ffs.io",
        "description": "Where our internet-facing services are accessed",
        "impact": "Tier 1"
      },
      {
        "type": "ios",
        "endpoint": "1052238659",
        "description": "The public seed of the Monzo app on iOS",
        "impact": "Tier 2"
      },
      {
        "type": "android",
        "endpoint": "co.uk.getmondo",
        "description": "The public seed of the Monzo app on Android",
        "impact": "Tier 2"
      },
      {
        "type": "url",
        "endpoint": "www.monzo.com",
        "description": null,
        "impact": "Tier 3"
      },
      {
        "type": "url",
        "endpoint": "monzo.com",
        "description": null,
        "impact": "Tier 3"
      }
    ],
    "out_of_scope": [
      {
        "type": "wildcard",
        "endpoint": "*/p2p/*",
        "description": null,
        "impact": "Out of scope"
      },
      {
        "type": "wildcard",
        "endpoint": "*/contact-discovery/*",
        "description": null,
        "impact": "Out of scope"
      },
      {
        "type": "wildcard",
        "endpoint": "*/inbound-p2p/*",
        "description": null,
        "impact": "Out of scope"
      },
      {
        "type": "wildcard",
        "endpoint": "*.monzo.me",
        "description": "Houses the services for the pay me/request payment feature",
        "impact": "Out of scope"
      },
      {
        "type": "url",
        "endpoint": "community.monzo.com",
        "description": "We use a third-party, Discourse for our community forums. Third-parties are out of scope for our programs.",
        "impact": "Out of scope"
      },
      {
        "type": "url",
        "endpoint": "login.internal.monzo.com",
        "description": "This is our connection to Okta for internal authentication. Third-parties are out of scope for our programs. ",
        "impact": "Out of scope"
      },
      {
        "type": "url",
        "endpoint": "monzo.me",
        "description": "Monzo.me is a service that allows Monzo users to easily receive money from others via a personalised link, even if the sender doesn't have a Monzo account.",
        "impact": "Out of scope"
      }
    ]
  }
}