- Top reward
- $500
- Top severity paid
- Critical
- Assets in scope
- 0
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $500
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$500 from $150 |
| High |
|
$150 from $50 |
| Medium |
|
$50 from $20 |
| Low |
|
$20 from $10 |
- Response
-
Within 5 days
We aim to responding in 5 days, triaging within 10 days and resolution in 30 days.
- Safe harbor
-
Full
We will not take legal action against you for good faith security research
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
0 assets you may test.
HackerOne does not list the scope of this program publicly. Check its policy.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from CoinMate.io (via HackerOne)'s policy. "We" in these lines means the program, not this site.
Not accepted
-
Social engineering attacks (e.g., phishing, vishing)
-
Physical security vulnerabilities
-
Denial of service (DoS/DDoS)
-
Vulnerabilities in third-party software or services not maintained by us
-
Reports based on automated scans without clear evidence of exploitability
-
3rd party password leaks (except employee passwords)
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Vulnerability Disclosure Policy
We take the security of our systems seriously and value the contributions of the security community. This policy outlines how to responsibly report vulnerabilities to us and what you can expect in return.
Reporting Guidelines
If you believe you have discovered a vulnerability in our systems, products, or services, we encourage you to report it to us privately and responsibly.
Please include the following details in your report:
- A detailed description of the vulnerability
- The steps required to reproduce the issue
- Any relevant URLs, payloads, screenshots, or logs
- The potential impact and any suggested remediation
We aim to responding in 5 days, triaging within 10 days and resolution in 30 days.
Ineligible:
- Social engineering attacks (e.g., phishing, vishing)
- Physical security vulnerabilities
- Denial of service (DoS/DDoS)
- Vulnerabilities in third-party software or services not maintained by us
- Reports based on automated scans without clear evidence of exploitability
- 3rd party password leaks (except employee passwords)
Exclusions
To remain eligible for recognition or rewards:
- Do not make any vulnerability or associated data public without our prior written consent
- Do not violate any laws or disrupt services during testing
- Do not access, modify, or delete any data that does not belong to you
What You Can Expect
- We will respond to your report promptly
- We will not take legal action against you for good faith security research
- We will keep you informed about the status of your report
- If eligible, you may receive recognition and a bounty, depending on the severity and impact of the vulnerability
We appreciate your efforts to keep our systems secure and thank you for your contribution to improving our security posture.