Capital One
Vulnerability disclosure program on HackerOne capitalone.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 27
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 2 days
Capital One commits to provide prompt acknowledgement of receipt of all reports (within two business days of submission)
- Safe harbor
-
Full
By responsibly submitting your findings to Capital One in accordance with these guidelines Capital One agrees not to pursue legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
27 assets you may test, 18 excluded.
iOS apps 9
- 1008234539 Critical No bounty
- 1109537081 Critical No bounty
- 1291519134 Critical No bounty
- 1380744689 Critical No bounty
- 1450441660 Critical No bounty
- 407558537 Critical No bounty
- 481679012 Critical No bounty
- 808215470 Critical No bounty
- 907613256 Critical No bounty
Wildcard domains 9
- *.bluetarp.com Critical No bounty
- *.capitalone.ca Critical No bounty
- *.capitalone.com Critical No bounty
- *.capitalone.co.uk Critical No bounty
- *.capitaloneshopping.com Critical No bounty
- *.luma.co.uk Critical No bounty
- *.teamstercardnow.com Critical No bounty
- *.theunioncard.com Critical No bounty
- *.wikibuy.com Critical No bounty
Android apps 8
- ca.capitalone.enterprisemobilebanking Critical No bounty
- com.capitalone.atwork Critical No bounty
- com.capitalone.credittracker Critical No bounty
- com.capitalone.intellix.mobile.prod Critical No bounty
- com.capitalone.tz Critical No bounty
- com.ie.capitalone.uk Critical No bounty
- com.konylabs.capitalone Critical No bounty
- com.ukcapitalone.creditWise Critical No bounty
Products and areas 1
- Eno® Browser Extension Critical No bounty
Out of scope (18)
- com.yinzcam.facilities.verizon
- api-an.capitalone.com/private/1289118/sdu/*
- http://api-an.capitalone.com/private/907765/digital-intake
- 414607046
- asos-idcheck.capitalone.co.uk
- idcheck.capitalone.co.uk
- jamfproqa.capitalone.com
- littlewoods-idcheck.capitalone.co.uk
- luma-idcheck.capitalone.co.uk
- ocean-idcheck.capitalone.co.uk
- postoffice-idcheck.capitalone.co.uk
- thinkmoney-idcheck.capitalone.co.uk
- travel.capitalone.com
- travel-qa.capitalone.com
- very-idcheck.capitalone.co.uk
- *.criticalstack.com
- *.intelstack.com
- *.unitedincome.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Capital One (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Do not engage in any activity that can potentially or actually cause harm to Capital One, our customers, or our employees.
-
Do not engage in any activity that can potentially or actually stop or degrade Capital One services or assets.
-
No automated scanning or testing.
-
Do not store, share, compromise or destroy Capital One or customer data.
-
Do not initiate a fraudulent financial transaction.
-
Provide Capital One reasonable time to fix any reported issue, before such information is shared with a third party or disclosed publicly.
Not accepted
-
Physical Testing
-
Social Engineering. For example, attempts to steal cookies, fake login pages to collect credentials
-
Phishing
-
Denial of service attacks
-
Resource Exhaustion Attacks
-
Clickjacking on pages with no sensitive actions
-
The submission of form data via HTTP sites
-
Google Maps API key exposure/misconfiguration(s)
-
Zombie Zoom links for expired Capital One meetings
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 30 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
api-an.capitalone.com/private/1289118/sdu/* (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Responsible Disclosure
Capital One is committed to maintaining the security of our systems and our customers’ information. We appreciate and encourage security researchers to contact us to report potential vulnerabilities identified in any product, system, or asset belonging to Capital One.
If you believe you have identified a potential security vulnerability, please submit it pursuant to our Responsible Disclosure Program. Thank you in advance for your submission, we appreciate researchers assisting us in our security efforts.
Responsible Disclosure Program Guidelines
Researchers shall disclose potential vulnerabilities in accordance with the following guidelines:
- Do not engage in any activity that can potentially or actually cause harm to Capital One, our customers, or our employees.
- Do not engage in any activity that can potentially or actually stop or degrade Capital One services or assets.
- Do not engage in any activity that violates (a) federal or state laws or regulations or (b) the laws or regulations of any country where (i) data, assets or systems reside, (ii) data traffic is routed or (iii) the researcher is conducting research activity.
- No automated scanning or testing.
- Do not store, share, compromise or destroy Capital One or customer data. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity, purge related data from your system, and immediately contact Capital One. This step protects any potentially vulnerable data, and you.
- Do not initiate a fraudulent financial transaction.
- Provide Capital One reasonable time to fix any reported issue, before such information is shared with a third party or disclosed publicly.
By responsibly submitting your findings to Capital One in accordance with these guidelines Capital One agrees not to pursue legal action against you. Capital One reserves all legal rights in the event of noncompliance with these guidelines.
Once a report is submitted, Capital One commits to provide prompt acknowledgement of receipt of all reports (within two business days of submission) and will keep you reasonably informed of the status of any validated vulnerability that you report through this program.
Submission Format
When reporting a potential vulnerability, please include a detailed summary of the vulnerability, including the target, steps, tools, and artifacts used during discovery (screen captures welcome).
Scope
We have listed the assets in scope for this program, however, if you have found a potential vulnerability (excluding the out of scope vulnerabilities listed below) on any product, system or asset you believe belongs to Capital One, please submit it through this program as we would like to hear about it.
Out of Scope Vulnerabilities
Certain vulnerabilities are considered out of scope for our Responsible Disclosure Program. Out-of-scope vulnerabilities include:
- Physical Testing
- Social Engineering. For example, attempts to steal cookies, fake login pages to collect credentials
- Phishing
- Denial of service attacks
- Resource Exhaustion Attacks
- Clickjacking on pages with no sensitive actions
- The submission of form data via HTTP sites
- Google Maps API key exposure/misconfiguration(s)
- Zombie Zoom links for expired Capital One meetings
Please also note that Capital One employs third party vendors and some subdomains may be managed by third parties. Security issues found in third-party assets which are not managed by Capital One are considered out of scope and should be reported to the affected party directly. When issues reported to the Capital One program originate in a different vendor's service, Capital One reserves the right to forward submissions to the affected party without further discussion. Please be sure to check our publicly published IP ranges and conduct all necessary due diligence to determine ownership of an asset prior to testing.