Capital One bug bounty programs
capitalone.com Updated
Capital One runs three public programs: a HackerOne bug bounty paying up to $5,000, a HackerOne disclosure program with no cash rewards and a self-hosted disclosure program with no cash rewards.
- Top reward
- $5,000
- HackerOne
- Programs
- 3
- 1 pays cash
- Targets in scope
- 32
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Capital One Bug Bounty
HackerOne · Pays the most of the 3 programs: up to $5,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Capital One Bug Bounty
HackerOne · Bug bounty |
$5,000 (highest) | $2,500 (highest) | $750 (highest) | $250 (highest) | $5,000 | Full | – | 1 hour average | Open |
|
Capital One
HackerOne · Disclosure only |
– | – | – | – | No cash | Full | – | 2 days promised | Open |
|
Capital One
Self-hosted · Disclosure only |
– | – | – | – | No cash | Partial | – | – | Open |
-
- Critical
- $5,000 (highest)
- High
- $2,500 (highest)
- Medium
- $750 (highest)
- Low
- $250 (highest)
- Safe harbor
- Full
- First response
- 1 hour average
-
- Safe harbor
- Full
- First response
- 2 days promised
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
32 targets across all 3 programs, each listed once with the programs that cover it. 23 excluded.
-
Capital One Shopping Browser Extension
Products and areas Critical
Covered by Capital One Bug Bounty
No target matches. Try part of a host name, such as the company name.
Out of scope 23
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.criticalstack.com
Capital One
-
*.intelstack.com
Capital One
-
*.unitedincome.com
Capital One
-
asos-idcheck.capitalone.co.uk
Capital One
-
idcheck.capitalone.co.uk
Capital One
-
jamfproqa.capitalone.com
Capital One
-
littlewoods-idcheck.capitalone.co.uk
Capital One
-
luma-idcheck.capitalone.co.uk
Capital One
-
ocean-idcheck.capitalone.co.uk
Capital One
-
postoffice-idcheck.capitalone.co.uk
Capital One
-
thinkmoney-idcheck.capitalone.co.uk
Capital One
-
travel-qa.capitalone.com
Capital One
-
travel.capitalone.com
Capital One
-
very-idcheck.capitalone.co.uk
Capital One
-
api-an.capitalone.com/private/1289118/sdu/*
Capital One Bug Bounty Capital One
-
http://api-an.capitalone.com/private/907765/digital-intake
Capital One Capital One Bug Bounty
-
com.yinzcam.facilities.verizon
Capital One
-
414607046
Capital One
-
Denial of service attacks
Self-hosted
-
Phishing
Self-hosted
-
Physical Testing
Self-hosted
-
Resource Exhaustion Attacks
Self-hosted
-
Social Engineering. For example, attempts to steal cookies, fake login pages to collect credentials
Self-hosted
Recent changes
Reward and scope changes across every Capital One program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under capitalone.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.