TrueLayer

{
  "id": "ed04d1ef-1aa3-49dd-92f1-06f50f9756b9",
  "url": "https://www.intigriti.com/programs/truelayer/truelayer/detail",
  "name": "TrueLayer",
  "handle": "truelayer",
  "status": "open",
  "targets": {
    "in_scope": [
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "api.truelayer[-sandbox].com",
        "description": "The majority of our API endpoints live here"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "api.mtls.truelayer[-sandbox].com",
        "description": "The same API as `api.truelayer[-sandbox].com` but with mutual TLS setup"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "auth.truelayer[-sandbox].com",
        "description": "Our service for getting OAuth access tokens to access our APIs"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "auth.mtls.truelayer[-sandbox].com",
        "description": "The same service as `auth.truelayer[-sandbox].com` but with mutual TLS setup"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "app.truelayer[-sandbox].com",
        "description": "Hosted Payments Page v2"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "login-api.truelayer[-sandbox].com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "login.truelayer[-sandbox].com",
        "description": "Where you can connect your bank account and use Open Banking to pull data such as transactions"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "onboarding-api.truelayer.com",
        "description": "Used in the developer console"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "pay-api.truelayer[-sandbox].com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "pay.truelayer[-sandbox].com",
        "description": "Some of our older payment API endpoints live here rather than on api.truelayer.com"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "paydirect.truelayer[-sandbox].com",
        "description": "Some of our older payment API endpoints live here rather than on api.truelayer.com"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "payment.truelayer[-sandbox].com",
        "description": "Our hosted payments page for merchants that want us to manage the UI screens for making payments"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "payments-experience-api.truelayer[-sandbox].com",
        "description": "Hosted Payments Page dependency (e.g. for handoff)"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "user-authentication-api.truelayer[-sandbox].com",
        "description": "Remember Me functionality for payments. See https://truelayer.com/legal/enduser_tos/#save-my-details-remember-me"
      },
      {
        "type": "url",
        "impact": "Tier 1",
        "endpoint": "users-api.truelayer.com",
        "description": "Internal service for managing users"
      },
      {
        "type": "other",
        "impact": "Tier 2",
        "endpoint": "C# SDK",
        "description": "https://github.com/TrueLayer/truelayer-dotnet"
      },
      {
        "type": "url",
        "impact": "Tier 2",
        "endpoint": "console-backend.truelayer[-sandbox].com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Tier 2",
        "endpoint": "console.truelayer[-sandbox].com",
        "description": "Our developer console where you can login, create applications, manage your OAuth client ID/secret, upload public keys for request signing, view transactions"
      },
      {
        "type": "url",
        "impact": "Tier 2",
        "endpoint": "sftp.reports.truelayer.com",
        "description": "SFTP reporting functionality in the Console. See https://docs.truelayer.com/docs/sftp-in-console"
      },
      {
        "type": "other",
        "impact": "Tier 2",
        "endpoint": "Java SDK",
        "description": "https://github.com/TrueLayer/truelayer-java"
      },
      {
        "type": "other",
        "impact": "Tier 2",
        "endpoint": "PHP SDK",
        "description": "https://github.com/TrueLayer/truelayer-php"
      },
      {
        "type": "other",
        "impact": "Tier 2",
        "endpoint": "TrueLayer for Magento (Magento plugin)",
        "description": "https://github.com/TrueLayer/magento2"
      },
      {
        "type": "url",
        "impact": "Tier 2",
        "endpoint": "shopify-admin.truelayer.com",
        "description": "Shopify Plugin backend admin page. See https://docs.truelayer.com/docs/shopify"
      },
      {
        "type": "url",
        "impact": "Tier 2",
        "endpoint": "shop-pay-app-api.truelayer.com",
        "description": "Shopify Plugin backend API. See https://docs.truelayer.com/docs/shopify"
      },
      {
        "type": "other",
        "impact": "Tier 2",
        "endpoint": "truelayer-signing",
        "description": "https://github.com/TrueLayer/truelayer-signing is our open source library for generating signed requests for calling TrueLayer APIs. Many languages are supported including Rust, C#, NodeJS, Go, Java and PHP."
      },
      {
        "type": "url",
        "impact": "Tier 2",
        "endpoint": "webhooks.truelayer[-sandbox].com",
        "description": null
      },
      {
        "type": "wildcard",
        "impact": "Tier 3",
        "endpoint": "*.truelayer.cloud",
        "description": null
      },
      {
        "type": "wildcard",
        "impact": "Tier 3",
        "endpoint": "*.truelayer.com",
        "description": null
      },
      {
        "type": "wildcard",
        "impact": "Tier 3",
        "endpoint": "*.truelayer.io",
        "description": null
      },
      {
        "type": "other",
        "impact": "Tier 3",
        "endpoint": "iOS SDK",
        "description": "https://github.com/TrueLayer/TrueLayer-iOS-SDK"
      },
      {
        "type": "other",
        "impact": "Tier 3",
        "endpoint": "React Native SDK",
        "description": "https://github.com/TrueLayer/truelayer-react-native-sdk"
      },
      {
        "type": "other",
        "impact": "Tier 3",
        "endpoint": "Web SDK",
        "description": "https://www.npmjs.com/package/truelayer-web-sdk\n\nA lightweight web SDK for integrating Truelayer's payment services into your web application."
      },
      {
        "type": "other",
        "impact": "No Bounty",
        "endpoint": "Rust SDK",
        "description": "https://github.com/TrueLayer/truelayer-rust\n\nCurrently we are not paying bounties for this asset as it's still in alpha."
      }
    ],
    "out_of_scope": [
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "trust.truelayer.com",
        "description": null
      },
      {
        "type": "other",
        "impact": "Out of scope",
        "endpoint": "TrueLayer for WooCommerce (WordPress plugin)",
        "description": "https://wordpress.org/plugins/truelayer-for-woocommerce/ is our WordPress plugin allowing you to use TrueLayer as a checkout option in your WooCommerce store. The source code is also [available on GitHub](https://github.com/TrueLayer/truelayer-woocommerce)."
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "banks.truelayer.com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "careers.truelayer.com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "docs.truelayer.com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "docs.houston.truelayer.com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "https://truelayer.com/contact/",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "index.truelayer.com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "info.truelayer.com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "signin.truelayer.com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "support.truelayer.com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "status.truelayer.com",
        "description": null
      },
      {
        "type": "url",
        "impact": "Out of scope",
        "endpoint": "truelayer.zendesk.com",
        "description": null
      }
    ]
  },
  "max_bounty": {
    "value": 6000,
    "currency": "EUR"
  },
  "min_bounty": {
    "value": 75,
    "currency": "EUR"
  },
  "tacRequired": false,
  "company_handle": "truelayer",
  "twoFactorRequired": false,
  "confidentiality_level": "public"
}