Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Fifth Third Bank VDP

By Fifth Third Bank, National Association Vulnerability disclosure program on HackerOne 53.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
72
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 2 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Response
Within 2 days First Response | 2 days
Safe harbor
Full Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

72 assets you may test, 3 excluded.

Web 66

  • accessprovide.com Critical No bounty
  • bigdatahc.com Critical No bounty
  • celticfinance.com Critical No bounty
  • comerica.com Critical No bounty
  • comerica.net Critical No bounty
  • dividendfinance.com Critical No bounty
  • dividendsolar.com Critical No bounty
  • dtsconnex.com Critical No bounty
  • express.53.com Critical No bounty
  • franklin-street.com Critical No bounty
  • fspnc.com Critical No bounty
  • getprovide.com Critical No bounty
  • http://api.comerica.com Critical No bounty
  • http://cbc.comerica.com Critical No bounty
  • http://cbc-qa.comerica.com Critical No bounty
  • http://dataprivacy.comerica.com Critical No bounty
  • http://dobotapp.org Critical No bounty
  • http://fuse.bigdatahc.com Critical No bounty
  • http://icw.dmzprod.r53comerica.net Critical No bounty
  • http://mortgageadvisors.53.com Critical No bounty
  • http://mts-fraudadapter.us.comerica.net Critical No bounty
  • http://onlinecd.comerica.com Critical No bounty
  • http://q1webbanking.comerica.com Critical No bounty
  • http://q2webbanking.comerica.com Critical No bounty
  • http://qa1-services.usdirectexpress.com Critical No bounty
  • http://qa1-web.usdirectexpress.com Critical No bounty
  • https://ablreporter.53.com Critical No bounty
  • https://cdao.53.com/onboarding Critical No bounty
  • https://commercialcard.53.com Critical No bounty
  • https://dpm.53.com/identityservice/identityservice.asmx Critical No bounty
  • http://secure.franklin-street.com Critical No bounty
  • http://services.usdirectexpress.com Critical No bounty
  • https://express.53.com/portal Critical No bounty
  • http://sftp1.comerica.com Critical No bounty
  • https://globaltradedirect.53.com Critical No bounty
  • https://load-webescrow.info53.com Critical No bounty
  • https://lqm.53.com Critical No bounty
  • https://myapps.53.com/app/fifththird_degreedcontractor_1/exk5q7jnnuzgrrdct4h7/sso/saml Critical No bounty
  • https://onlinebanking.53.com Critical No bounty
  • https://openonline.53.com Critical No bounty
  • https://paypoint.us.comerica.net/bankvisibility/viewbankdashboard.do?param_methodkey:submit.view=link Critical No bounty
  • https://pingfederate-admin-ocp-prd-bc3574.ocpf.info53.com/pingfederate/app Critical No bounty
  • https://shipper-stage.info53.com/shipper/app Critical No bounty
  • https://slapmsp001.info53.com:9443 Critical No bounty
  • https://sys.express.53.com Critical No bounty
  • http://st2.comerica.com Critical No bounty
  • http://stg.usdirectexpress.com Critical No bounty
  • https://wsde260n-1.info53.com:481/olb/#/login Critical No bounty
  • http://token.comerica.com Critical No bounty
  • http://wealthconnect.comerica.com Critical No bounty
  • http://webbanking.comerica.com Critical No bounty
  • http://web.usdirectexpress.com Critical No bounty
  • http://www.transactiontracking.com Critical No bounty
  • http://www.usdirectexpress.com Critical No bounty
  • ifsservices.com Critical No bounty
  • lendeavor.com Critical No bounty
  • locations.53.com Critical No bounty
  • manageprovide.com Critical No bounty
  • newline53.com Critical No bounty
  • r53comerica.net Critical No bounty
  • sandbox.newline53.com Critical No bounty
  • testprovide.com Critical No bounty
  • usdirectexpress.com Critical No bounty
  • www.53.com Critical No bounty
  • zta.nube.53.com Critical No bounty
  • ztc.nube.53.com Critical No bounty

APIs 4

  • api.53.com High No bounty
  • api.newline53.com Medium No bounty
  • api.payments-api.nube.53.com High No bounty
  • api.rtpapi-stg.nube.53.com Medium No bounty

Networks 1

  • 216.131.54.65 Critical No bounty

Wildcard domains 1

  • *53.com Critical No bounty
Out of scope (3)
  • http://cloud.e.comerica.com
  • http://smallbusiness.comerica.com
  • http://smallbusinessuat.comerica.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Fifth Third Bank VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may be closed as Information or N/A.
  • Multiple vulnerabilities caused by one underlying issue will be treated as one vulnerability; the first report will be triaged as the original, and all future reports will be closed as Duplicate.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Only interact with accounts you own or with explicit permission of the account holder.
  • Large-scale vulnerability scanners, scrapers, or automated tools which produce excessive amounts of traffic are prohibited at this time.
  • Include a custom HTTP header in all your traffic. Burp and other proxies allow the easy automatic addition of headers to all outbound requests
  • For anything that requires credentials researchers must use their `@wearehackerone.com` email alias as part of the HackerOne platform.

Not accepted

  • Tabnabbing
  • Publicly accessible login panels
  • Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin: * or accepting of custom Origin header that do not specifically show a valid attack scenario.
  • Reports from automated tools or scans
  • Host Header Injection (Unless it gives you access to interim proxies)
  • IP Address Disclosure
  • Bugs in content/services that are not owned/operated by 5/3.
  • CSRF on forms that are available to anonymous users.
  • Clickjacking and issues that are only exploitable through clickjacking.
  • Descriptive error messages (e.g. Stack Traces, application or server errors) that have no security implications.
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages.
  • Fingerprinting / banner disclosure on common/public services.
  • Disclosure of known public files or directories, (e.g. robots.txt, crossdomain.xml, p3p.xml).
  • Lack of Secure and HTTPOnly cookie flags.
  • Email configuration issues (SPF, DKIM, DMARC).
  • Forced Login / Logout CSRF.
  • Account lockout by repetitive incorrect password submissions.
  • Password complexity or account recovery policies.
  • HTTPS Mixed Content.
  • Missing HTTP security headers, specifically: Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, and Content-Security-Policy.
  • OPTIONS HTTP method enabled.
  • Missing best practices in SSL/TLS configuration
  • Use of a known-vulnerable library without evidence of exploitability.
  • Attacks requiring physical access to a user’s unlocked device.
  • Reports of spam, phishing, or security best practices.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 44 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    http://fuse.bigdatahc.com

  2. Scope added

    http://secure.franklin-street.com

  3. Scope added

    http://cloud.e.comerica.com (out of scope)

  4. Scope added

    https://wsde260n-1.info53.com:481/olb/#/login

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Welcome to Fifth Third Bank Vulnerability Disclosure Program!

Fifth Third Bank, National Association is dedicated to proactively advance our security, identify new vulnerabilities and help keep our customer information secure. We value the important role of the security community in helping us mitigate information security risk as the threat landscaping continuous to evolve.

Response Targets

Fifth Third Bank will make a best effort to meet the following SLAs for hackers participating in our program:

Type of Response SLA in business days
First Response 2 days
Time to Triage 10 days
Time to Resolution depends on severity and complexity

We’ll try to keep you informed about our progress throughout the process.

Disclosure Policy

Program Rules

  • Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may be closed as Information or N/A.
  • Multiple vulnerabilities caused by one underlying issue will be treated as one vulnerability; the first report will be triaged as the original, and all future reports will be closed as Duplicate.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Only interact with accounts you own or with explicit permission of the account holder.
  • Large-scale vulnerability scanners, scrapers, or automated tools which produce excessive amounts of traffic are prohibited at this time.

To participate in our program we ask that you configure your tools accordingly. This will help us best determine that you are a researcher participating in our program and will help reduce they likelihood that you are blocked from our systems.

(1) HTTP Headers:

Include a custom HTTP header in all your traffic. Burp and other proxies allow the easy automatic addition of headers to all outbound requests

Identifier: Your Username Format: X-Bug-Bounty:HackerOne- Example: X-Bug-Bounty: HackerOne-flyingtoasters

Identifier: Tool Identifier Format: X-Bug-Bounty: Example: X-Bug-Bounty: BurpSuitePro

(2) @wearehackerone.com email alias:

For anything that requires credentials researchers must use their @wearehackerone.com email alias as part of the HackerOne platform.

Known issues

Please note that the Fifth Third Security Team also actively looks for vulnerabilities across all assets internally. For reported issues that are already known to us, we will close them as duplicates. We seek your kind cooperation to respect our final decision and to refrain from making multiple negotiations once the decision has been made.

Qualifying Vulnerabilities (In Scope)

We are interested in the following types of vulnerabilities:

  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Insecure Direct Object References (IDOR)
  • Injection Vulnerabilities
  • Authentication Vulnerabilities
  • Server-Side Code Execution
  • Privilege Escalation
  • Directory Traversal
  • Information Disclosure
  • Open Redirects

Non-Qualifying Vulnerabilities (Out of Scope)

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope.

The following issues are considered out of scope:

  • We do not accept purchased credentials from the web/dark web without an associated vulnerability (we only accept credential submissions when they are directly tied to a vulnerability being actively reported or if the vulnerability demonstrates how the credentials were compromised)
  • Multiple small credential submissions that could reasonably be included in a single report
  • Credentials obtained from 3rd party breaches without demonstrating a direct impact on our systems (any credential submissions that do not meet these requirements will be close as Not Applicable)
  • No reports will be accepted that require sending a user malware
  • Tabnabbing
  • Publicly accessible login panels
  • Cross-Origin Resource Sharing (CORS) Access-Control-Allow-Origin: * or accepting of custom Origin header that do not specifically show a valid attack scenario.
  • Reports from automated tools or scans
  • Host Header Injection (Unless it gives you access to interim proxies)
  • IP Address Disclosure
  • Bugs in content/services that are not owned/operated by 5/3.
  • CSRF on forms that are available to anonymous users.
  • Clickjacking and issues that are only exploitable through clickjacking.
  • Descriptive error messages (e.g. Stack Traces, application or server errors) that have no security implications.
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages.
  • Fingerprinting / banner disclosure on common/public services.
  • Disclosure of known public files or directories, (e.g. robots.txt, crossdomain.xml, p3p.xml).
  • Lack of Secure and HTTPOnly cookie flags.
  • Email configuration issues (SPF, DKIM, DMARC).
  • Forced Login / Logout CSRF.
  • Account lockout by repetitive incorrect password submissions.
  • Password complexity or account recovery policies.
  • HTTPS Mixed Content.
  • Missing HTTP security headers, specifically: Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, and Content-Security-Policy.
  • OPTIONS HTTP method enabled.
  • Missing best practices in SSL/TLS configuration
  • Use of a known-vulnerable library without evidence of exploitability.
  • Attacks requiring physical access to a user’s unlocked device.
  • Reports of spam, phishing, or security best practices.
  • Issues that require unlikely user interaction.
  • Attacks requiring MITM or physical access to a user's device.
  • Information disclosures that only reveal email address or phone numbers.
  • Information Disclosure: If a document is deemed not actually sensitive or classified, then Fifth Third Bank will mark it as informational and close the vulnerability Cache Poisoning/Akamai Configurations: Akamai’s default configuration applies negative caching to HTTP 400 responses for 10 seconds, limited to the individual edge server that processed the request rather than across the full CDN. This behavior is part of the standard platform baseline and is intended to safeguard both customer environments and shared infrastructure. The negative caching of 400 is in our code baseline and in place to protect you, as well as all Akamai customers' infrastructure, from attackers making volumetric requests for assets that do not exist on the end user's side. This helps in preventing Denial of Service at the origin. Cache poisoning submissions that do not account for these factors will not be accepted.

Test Instructions

  • All assets in scope are on production; no VPN or credentials are required for testing.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Fifth Third Bank and our users safe!