- Top reward
- $6,000
- Top severity paid
- Critical
- Assets in scope
- 47
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $6,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$6,000 from $4,000 |
| High |
|
$3,000 from $1,500 |
| Medium |
|
$600 from $400 |
| Low |
|
$200 from $50 |
- Safe harbor
-
Partial
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
47 assets you may test.
Web 45
- ads-partners.tw.coupang.com Critical
- cart-front-api.tw.coupang.com Critical
- cart.tw.coupang.com Critical
- cash.tw.coupang.com Critical
- checkout.tw.coupang.com Critical
- cmapi.tw.coupang.com Critical
- dco.tw.coupang.com Critical
- developers.tw.coupangcorp.com Critical
- feed-web.tw.coupang.com Critical
- fileupload.tw.coupang.com Critical
- fileupload-video.tw.coupang.com Critical
- fintech-aml-kyc-tw.coupang.com Critical
- go-cms.tw.coupang.com Critical
- helpcenter-tw.coupangcorp.com Critical
- helpseller.tw.coupangcorp.com Critical
- id.tw.coupang.com Critical
- influencers.tw.coupang.com Critical
- link.tw.coupang.com Critical
- ljc-test.tw.coupang.com Critical
- ljc.tw.coupang.com Critical
- logs-partners.tw.coupang.com Critical
- loyalty.tw.coupang.com Critical
- marketplace.tw.coupangcorp.com Critical
- mauth.tw.coupang.com Critical
- mc.tw.coupang.com Critical
- member.tw.coupang.com Critical
- m.tw.coupang.com Critical
- myself.tw.coupang.com Critical
- my.tw.coupang.com Critical
- notification-front-web.tw.coupang.com Critical
- pages.tw.coupang.com Critical
- partners.tw.coupang.com Critical
- payment.tw.coupang.com Critical
- pay.tw.coupang.com Critical
- promo.tw.coupang.com Critical
- reco.tw.coupang.com Critical
- review.tw.coupang.com Critical
- rs-open-api.tw.coupang.com Critical
- shop.tw.coupang.com Critical
- store-display.tw.coupang.com Critical
- syndication.tw.coupang.com Critical
- tw.coupang.com Critical
- tw.coupangcorp.com Critical
- tw.coupangls.com Critical
- www.tw.coupang.com Critical
Android apps 1
- SUPERAPP (AOS) Critical
iOS apps 1
- SUPERAPP (IOS) Critical
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Coupang Taiwan (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please provide detailed reports with reproducible steps.
-
Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
-
Social engineering (e.g., phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Ask the program team before submitting vulnerabilities on unscoped subdomains.
-
Only interact with accounts you own or with the explicit permission of the account holder.
-
Please use your **hacker email alias** when testing ([email protected]).
-
Do not attempt any intrusive actions that could compromise the integrity and functionality of our LLM systems (including data poisoning and unauthorized data deletion).
Not accepted
-
Reports related to the exposure of such information are not eligible for a bounty.
-
Duplicate or previously addressed account leak reports are marked ineligible
-
unverifiable or already known leaks do not
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 7 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Rules updated
Added: “Seller and vendor information (e.g., business name, representative name, business address) is subject to mandatory public disclosure under applicable e-commerce...”
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Disclosure Policy
- Even though this is a public program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's disclosure guidelines.
Program Rules
Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
- Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only award the first report received (provided it can be fully reproduced).
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
- Social engineering (e.g., phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
- Ask the program team before submitting vulnerabilities on unscoped subdomains.
- Only interact with accounts you own or with the explicit permission of the account holder.
- Reports for publicly disclosed Zero-day vulnerabilities that have had an official patch for less than one month will be accepted only on a case-by-case basis.
- Coupang Taiwan accepts reports of leaked credentials, including authentication material for Coupang APIs and infrastructure. Duplicate or previously addressed account leak reports are marked ineligible, and all submissions must include verifiable evidence such as data sources, account samples, and account type details. Only fully validated reports with no prior response history qualify for reward, while unverifiable or already known leaks do not.
- Please note that Coupang’s Taiwan and Korea assets might have overlapping backend code. Because of this overlap, vulnerabilities that require the same fix across Korea, Taiwan, iOS, or Android will be treated as a single vulnerability report, and only the first valid submission (from either host) will receive the bounty. Any subsequent submissions for that same issue on either host will be marked as duplicates.
- Coupang reserves the right to determine a researcher's testing activity before awarding any bounty for a valid report.
- Vulnerabilities affecting assets not listed as part of Coupang's scope are not eligible for a bounty. If you find a vulnerability in a vendor or third-party that directly affects Coupang, we will accept it and work with the third party on a best-effort basis to remediate the issue. However, in certain exceptional cases, if we decide to reward, the decision will be at our discretion.
- For LLM-related vulnerabilities: Do not attempt any intrusive actions that could compromise the integrity and functionality of our LLM systems (including data poisoning and unauthorized data deletion). Respect the boundaries of your testing activities. Any actions that could potentially harm our LLM systems or lead to unintended consequences are strictly prohibited. Always make an effort in good faith to protect our LLM systems and data.
- Seller and vendor information (e.g., business name, representative name, business address) is subject to mandatory public disclosure under applicable e-commerce regulations in Korea and Taiwan and is not classified as PII. Reports related to the exposure of such information are not eligible for a bounty.
- Reports targeting the same root cause across different parameters, endpoints, or assets will be treated as a single finding. Subsequent reports will be closed as duplicates.
- A single data incident submitted as multiple reports will be treated as one incident regardless of the number of reports. Intentional report splitting to inflate payouts may result in reports being closed without reward.
Test Plan
- Users can sign up for a free account through our website (when applicable).
- Please note that a Taiwanese phone number may be required to complete account verification during registration. Coupang Taiwan and the HackerOne Support Team cannot provide test accounts at this time. Researchers are responsible for obtaining valid phone number required for testing.
- Please use your hacker email alias when testing ([email protected]).
Session Layer: Researcher Identification
To help identify researcher traffic, please include your HackerOne username in both the request header and User-Agent string.
- Header: X-HackerOne-Researcher: [H1 username]
- User-Agent: Mozilla/5.0 (...; X-HackerOne-Researcher: [H1 username]) AppleWebKit/...
Thank you for helping keep Coupang Corp and our users safe!