Razorpay bug bounty programs
razorpay.com Updated
Razorpay runs three public programs: a Bugbase bug bounty paying up to $3,000, a HackerOne bug bounty paying up to $3,000 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $3,000
- Bugbase
- Programs
- 3
- 2 pay cash
- Targets in scope
- 7
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Razorpay BugBounty
Bugbase · Pays the most of the 3 programs: up to $3,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Razorpay BugBounty
Bugbase · Bug bounty |
$3,000 (highest) | $1,500 (highest) | $500 (highest) | $200 (highest) | $3,000 | – | – | – | Open |
|
Razorpay
HackerOne · Bug bounty |
$3,000 | $1,000 | $500 | $200 | $3,000 | Full | – | 3 days average | Open |
|
Razorpay
Self-hosted · Disclosure only |
– | – | – | – | No cash | Full | – | – | Open |
-
- Critical
- $3,000 (highest)
- High
- $1,500 (highest)
- Medium
- $500 (highest)
- Low
- $200 (highest)
-
- Critical
- $3,000
- High
- $1,000
- Medium
- $500
- Low
- $200
- Safe harbor
- Full
- First response
- 3 days average
-
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
7 targets across all 3 programs, each listed once with the programs that cover it. 30 excluded.
No target matches. Try part of a host name, such as the company name.
Out of scope 30
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Any service that is not mentioned in the In Scope domains section
Self-hosted
-
Any services hosted by 3rd party providers and services not provided by Razorpay
Self-hosted
-
Cacheable SSL pages
Self-hosted
-
Clickjacking and issues only exploitable through clickjacking
Self-hosted
-
Disclosure of known public files or directories, (e.g. robots.txt)
Self-hosted
-
DOM Based Self-XSS and issues exploitable only through Self-XSS.
Self-hosted
-
Duplicate submissions that are being remediated
Self-hosted
-
Email bombs
Self-hosted
-
Fingerprinting / banner disclosure on common/public services
Self-hosted
-
Forgot Password page bruteforce and account lockout not enforced
Self-hosted
-
Formula Injection or CSV Injection
Self-hosted
-
Gmail "+" and "." acceptance
Self-hosted
-
HTTP 404 codes/pages or other HTTP non-200 codes/pages
Self-hosted
-
IDOR references for objects that you have permission to access
Self-hosted
-
Issues without clearly identified security impact such as missing security headers.
Self-hosted
-
Known issues
Self-hosted
-
Lack of Captcha
Self-hosted
-
Missing CAA headers
Self-hosted
-
Multiple reports for the same vulnerability type with minor differences (only one will be rewarded)
Self-hosted
-
Networking issues or industry standards
Self-hosted
-
Only session cookies needed http and secure flags. Apart from these, for other cookies we won’t consider as vulnerability
Self-hosted
-
Open redirects
Self-hosted
-
Password complexity
Self-hosted
-
Patches released within the last 30 days
Self-hosted
-
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality
Self-hosted
-
Rate limiting (Unless it implies severe threat to data, business loss)
Self-hosted
-
Session Timeouts
Self-hosted
-
SPF or DMARC records
Self-hosted
-
Unsubscribing from marketing emails
Self-hosted
-
Vulnerabilities requiring physical access to the victim's unlocked device.
Self-hosted
Recent changes
Reward and scope changes across every Razorpay program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Razorpay products, from the NVD.
-
CVE-2024-10850 Medium
The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into
-
CVE-2024-10851 Medium
The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing
-
CVE-2024-10850 Medium
The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into
-
CVE-2024-10851 Medium
The Razorpay Payment Button Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing
About this page
This page gathers every public program listed under razorpay.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.