Does Bug Bounty Program - BlaBlaCar have a bug bounty program?

Yes, Bug Bounty Program - BlaBlaCar runs a public bug bounty program on YesWeHack, with rewards €50 – €3.0K. It currently lists 6 in-scope assets.

How much does Bug Bounty Program - BlaBlaCar pay for bug bounties?

Bug Bounty Program - BlaBlaCar's published reward range on YesWeHack is €50 – €3.0K. Actual payouts depend on severity and scope.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/YesWeHack/bug-bounty-program-blablacar

Bug Bounty Program - BlaBlaCar

YesWeHack·updated 6h ago

bountyopen

Discord → RSS

reward band: €50 – €3.0K
scope: 6 in · 3 out
safe harbor: unknown
response: no reports

open program

signalsscope ×0.5 in 90dderived from our snapshot history

hunt score

$cashfresh

formula →

payout

16/55

bounty

20/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

6 in-scope

2apis
2urls
1android
1ios

Scope

In scope

006

urls02

apis02

android01

+play.google.com/store/apps/details?id=com.comuto&hl=en

ios01

+itunes.apple.com/fr/app/blablacar-…pooling/id341329033?l=en&mt=8

Out of scope

003

−Any website that is not listed explicitly in the scope.other
−However, though listed in the out-…ill reward you with a bounty.other
−Finally, fraud related reports are…exploit for example is valid.other

Change history

2 events

in-scope over 75dpeak 11

first indexedscope addedscope removedreward change

2026-10-20
− removed 5 scopes
17d ago
2026-08-06
first indexed
92d ago · 11 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Bug Bounty Program - BlaBlaCar.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": "bug-bounty-program-blablacar",
  "name": "Bug Bounty Program - BlaBlaCar",
  "public": true,
  "managed": null,
  "targets": {
    "in_scope": [
      {
        "type": "api",
        "target": "https://edge.blablacar.(fr|de|co.uk|in|es|mx|be|hr|hu|it|nl|pl|com.br|pt|ro|ru|com|tr|com.ua))"
      },
      {
        "type": "api",
        "target": "https://auth.blablacar.(fr|de|co.uk|in|es|mx|be|hr|hu|it|nl|pl|com.br|pt|ro|ru|com|tr|com.ua)"
      },
      {
        "type": "web-application",
        "target": "https://www.blablacar.(fr|de|co.uk|in|es|mx|be|hr|hu|it|nl|pl|com.br|pt|ro|ru|com|tr|com.ua)"
      },
      {
        "type": "web-application",
        "target": "https://m.blablacar.(fr|de|co.uk|in|es|mx|be|hr|hu|it|nl|pl|com.br|pt|ro|ru|com|tr|com.ua)"
      },
      {
        "type": "mobile-application-android",
        "target": "https://play.google.com/store/apps/details?id=com.comuto&hl=en"
      },
      {
        "type": "mobile-application-ios",
        "target": "https://itunes.apple.com/fr/app/blablacar-trusted-carpooling/id341329033?l=en&mt=8"
      }
    ],
    "out_of_scope": [
      {
        "type": "other",
        "target": "Any website that is not listed explicitly in the scope."
      },
      {
        "type": "other",
        "target": "However, though listed in the out-of-scope list, if you really feel that a bug will leave an impact on our platform, please come up with a convincing and working POC. If that convinces us to change our code, we will reward you with a bounty."
      },
      {
        "type": "other",
        "target": "Finally, fraud related reports are out-of-scope if they do not exploit a security vulnerability. Therefore, fraud activity enabled by bug or incomplete business rules enforcement are out-of-scope.  However, a fraud activity enabled by a CSRF exploit for example is valid."
      }
    ]
  },
  "disabled": false,
  "max_bounty": 3000,
  "min_bounty": 50
}