Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

GoCardless Bug Bounty Program

By GoCardless Bug bounty on HackerOne gocardless.com

Accepting reports Full safe harbor
Go to program Website
Top reward
$900
Top severity paid
Critical
Assets in scope
20
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $900
for critical bugs.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $900
High $450
Medium $150
Low $50
Safe harbor
Full All activities conducted in a manner consistent with this policy will be considered authorised conduct, and we will not initiate legal action against you.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

20 assets you may test, 28 excluded.

Web 11

  • api-sandbox.gocardless.com Critical
  • auth0.gocardless.com Medium No bounty
  • connect-sandbox.gocardless.com High
  • docs.gocardless.com Low
  • http://sso-demo.gocardless-staging.io Low No bounty
  • manage-sandbox.gocardless.com High
  • oauth-sandbox.gocardless.com High
  • ob.gocardless.com Medium
  • payer-details-sandbox.gocardless.com High
  • pay-sandbox.gocardless.com Critical
  • www.gocardless.com Low

Wildcard domains 6

  • *.gocardless-banking.io No bounty
  • *.gocardless-cicd.io Medium No bounty
  • *.gocardless.dev Informational No bounty
  • *.gocardless.io No bounty
  • *.gocardless.io,*.gocardless-banking.io High No bounty
  • *.gocardless-lab.io Low No bounty

APIs 1

  • https://ob-sandbox.gocardless.io Medium No bounty

Source code 1

  • https://github.com/gocardless Low

Products and areas 1

  • bankaccountdata.gocardless.com High No bounty
Out of scope (28)
  • gocardless.my.site.com
  • gocardless-status.com
  • partnerportal.gocardless.com
  • status.gocardless.com
  • gocardless-status.com, status.gocardless.com
  • partnerportal.gocardless.com, gocardless.my.site.com
  • https://github.com/gocardless/woocommerce-gateway-gocardless
  • api.gocardless.com
  • api-staging.gocardless.com
  • brand.gocardless.com
  • connect.gocardless.com
  • gc4x-api-sandbox.gocardless.com
  • gocardless.atlassian.net
  • learn.gocardless.com
  • manage.gocardless.com
  • oauth.gocardless.com
  • oauth-staging.gocardless.com
  • outgrow.gocardless.com
  • payer-details.gocardless.com
  • pay.gocardless.com
  • privacy.gocardless.com
  • qbo-api.gocardless.com
  • storybook.gocardless.io
  • support.gocardless.com
  • xero.gocardless.com
  • xero-sandbox.gocardless.com
  • xero-staging.gocardless.com
  • *.gocardless-staging.io

Rules

What the policy asks of you, and the bug types it won't reward, quoted from GoCardless Bug Bounty Program (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • You must include a working Proof of Concept.
  • You must include a security impact justification.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • You must not access, modify, copy, download, delete, compromise, or otherwise misuse others’ data.
  • You must not degrade, interrupt, or deny services to our users.
  • You must use your own accounts and not interact with other users’ accounts or data.
  • You must use your HackerOne email alias for accounts when conducting research on our platform.
  • No disruptive testing, or automated scanning is to be conducted, and only manual testing is permitted on the following in-scope domains:
  • Only connect the GC MCP and GC CLI tools to your Sandbox test accounts.

Not accepted

  • SSRF via Webhook URLs is a false positive; the proxy is specifically configured not to ping internal hosts
  • Unauthenticated logout/login CSRF, search request CSRF, CSRF on unauthenticated or otherwise non-sensitive pages
  • The `/flags` API endpoint returns Organisation IDs, Creditor IDs, and other organisation settings
  • Publicly available MCP /register endpoint
  • Sentry DSN, Optimizely, Braze, Segment, and other client-side API keys on the front-end - implementation follows vendor guidelines
  • Public user registration on Jira service desk
  • Public submission of Support tickets via Zendesk
  • Clickjacking
  • Attacks requiring MITM or physical access to a user's device
  • Previously known vulnerable libraries without a working Proof of Concept (PoC)
  • Comma-Separated Values (CSV) injection
  • Missing best practices in SSL/TLS configuration
  • Missing best practices in Content Security Policy (CSP)
  • Missing cookie flags
  • Missing security-specific HTTP headers (`X-Frame-Options`, `X-Content-Type-Options`, `Strict-Transport-Security`, etc.)
  • Missing email verification functionality
  • CORS misconfiguration without demonstrating a specific attack and its impact
  • Email best practices (invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.)
  • Minor technical information disclosure, such as software versions, sourcemaps, service banners, internal IDs, or health check endpoints
  • Rate-limiting issues that lead to spam
  • User or email enumeration
  • Hypothetical subdomain takeovers without supporting evidence
  • Open redirection
  • Support chat file uploads
  • We are no longer issuing rewards for reports of potential GoCardless credentials leaked on third-party sites.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 minutes ago.

  1. Back

    Open for reports again.

  2. Paused

    Paused. Not accepting reports right now.

  3. Closed

    No longer listed as a public program.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Status

    Program status changed

  2. Status

    Program status changed

  3. Status

    Program status changed

  4. Scope added

    https://github.com/gocardless/woocommerce-gateway-gocardless (out of scope)

  5. Rules updated

    Added: “The `gocardless/woocommerce-gateway-gocardless` repository is out of scope as it is developed and maintained by a third party.”

  6. Scope added

    https://github.com/gocardless

  7. Scope added

    developer.gocardless.com

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Disclosure Policy

The policy covers any public-facing website owned, operated, or controlled by GoCardless, including web applications hosted on those sites.

Please do not discuss any vulnerabilities (even resolved ones) outside of the program. We currently do not have a public disclosure policy, so any disclosure requests will be denied.

Response Targets

The bounty is typically paid out when a triaged issue has been remediated or within 30 days of setting the report as triaged.

Rules of Engagement

Your participation in our program is voluntary and subject to the following:

  • You must include a working Proof of Concept.
  • For source code repositories, you must include a Proof of Concept on a running instance of the service; unit tests will not be accepted.
  • You must include a security impact justification.
  • You must follow HackerOne platform rules.
  • Social engineering (e.g. phishing, vishing, smishing) is prohibited.
  • You must not threaten or try to extort GoCardless or our customers.
  • You must not access, modify, copy, download, delete, compromise, or otherwise misuse others’ data.
  • You must not access non-public information without authorisation.
  • You must not access production services or data without authorisation.
  • You must not degrade, interrupt, or deny services to our users.
  • You must not incur a loss of funds that are not your own.
  • You must use your own accounts and not interact with other users’ accounts or data.
  • You must use your HackerOne email alias for accounts when conducting research on our platform.
  • If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
  • When duplicate reports occur, only the first report that can be fully reproduced may be eligible for a reward at GoCardless' discretion.
  • Chained/Multiple vulnerabilities caused by a single underlying issue or root cause are eligible for a single reward at GoCardless' discretion.
  • Identical issues on multiple in-scope domains are eligible for a single reward at GoCardless' discretion.
  • Rate-limit issues are capped at Low impact.
  • DoS/DDoS issues are capped at Medium impact.
  • Leaked credential reports or WayBack Machine reports are not accepted.

Setting up accounts for vulnerability research

You must use a HackerOne email alias account for accounts configured in our environments (e.g., [email protected]). More details on HackerOne aliases: https://docs.hackerone.com/hackers/hacker-email-alias.html Please add "bug bounty" to the company or name field to make the account easily identifiable as belonging to a security researcher.

To get started on the GoCardless platform, we recommend that you review the extensive documentation about the types of accounts that can be set up:

Test In Sandbox Only

Please conduct all research and testing in our sandbox environment (e.g., https://manage-sandbox.gocardless.com).

No disruptive testing, or automated scanning is to be conducted, and only manual testing is permitted on the following in-scope domains:

! Only connect the GC MCP and GC CLI tools to your Sandbox test accounts.

Other than the above exception, we ask that you do NOT conduct testing and research on our production environments:

However, if you feel that there may be an issue that can only be reproduced in the production environment, please seek our consent for further testing via the HackerOne platform.

Third-party services and applications

Third-party Software-as-a-Service (SaaS) services and applications are out of scope, even if they are accessible under an in-scope domain. This would typically include services, such as Zendesk, Jira, Salesforce, or externally hosted forms. Please submit any findings related to such services and applications via the appropriate service provider's Vulnerability Disclosure program.

Our publicly supported GitHub repositories (https://github.com/gocardless?q=&type=public&language=&sort=) explicitly belonging to the GoCardless organisation and defining a security file are IN scope. GitHub repositories under the GoCardless organisation that are forks, mirrors, or archived, or have not been updated in over 2 years are OUT of scope. GitHub repositories not owned by GoCardless, but referencing our services or code, are OUT of scope.

The gocardless/woocommerce-gateway-gocardless repository is out of scope as it is developed and maintained by a third party.

When reporting findings related to our source code repositories, please provide a PoC on a running service. Unit tests will not be accepted as sufficient PoC.

Out of scope vulnerabilities

Not a Vulnerability

Behaviours commonly reported as findings that are intentional or do not present a threat:

  • SSRF via Webhook URLs is a false positive; the proxy is specifically configured not to ping internal hosts
  • Cross-organisation access to billing request actions - billing requests are public because they have to be available to unregistered Payers
  • Developer access tokens and partner app access tokens remain active after user deactivation by design, as they are scoped to the entire organisation
  • Unauthenticated logout/login CSRF, search request CSRF, CSRF on unauthenticated or otherwise non-sensitive pages
  • Merchant Dashboard read_only and read_write user access to some of the "developers" information and functionality
  • The /flags API endpoint returns Organisation IDs, Creditor IDs, and other organisation settings
  • Unverified user accounts being able to invite customers via direct API request - this is not an issue, since an unverified Merchant organisation will not be able to collect payments regardless
  • Merchants being able to call /billing_request_templates/:id/actions/use on other Merchants' templates - by design, Templates can be used to create Billing Requests in the owner's organisation by anonymous users, regardless of whether they belong to an organisation, hence there is no security or privacy impact to this
  • Publicly available MCP /register endpoint
  • Sentry DSN, Optimizely, Braze, Segment, and other client-side API keys on the front-end - implementation follows vendor guidelines
  • Issues related to privilege separation of admin & read_write users on GC4X: these roles have identical permissions by design
  • Public user registration on Jira service desk
  • Public submission of Support tickets via Zendesk

Social Engineering, Composite, and Hard-to-Exploit Vulnerabilities

When reporting vulnerabilities to GoCardless, please consider (1) the attack scenario and exploitability, and (2) the security impact of the finding. The following issues are considered out of scope unless you can demonstrate an exploitation approach that does not require social engineering, physical breach, or nation-state resources:

  • Clickjacking
  • Attacks requiring MITM or physical access to a user's device
  • Previously known vulnerable libraries without a working Proof of Concept (PoC)
  • Public zero-day vulnerabilities that have an official patch released for less than 30 days will be reviewed on a case-by-case basis
  • Comma-Separated Values (CSV) injection
  • Missing best practices in SSL/TLS configuration
  • Missing best practices in Content Security Policy (CSP)
  • Missing cookie flags
  • Missing security-specific HTTP headers (X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, etc.)
  • Missing email verification functionality
  • CORS misconfiguration without demonstrating a specific attack and its impact
  • Email best practices (invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.)
  • Vulnerabilities that only affect users of outdated or unpatched browsers and operating systems
  • Minor technical information disclosure, such as software versions, sourcemaps, service banners, internal IDs, or health check endpoints
  • Rate-limiting issues that lead to spam
  • Rate-limiting bypass or brute-forcing of endpoints not related to authentication
  • Content spoofing and text injection issues without a PoC that would not require direct modification of the page content
  • Content spoofing and text injection issues without a demonstration of security impact that isn't social engineering
  • User or email enumeration
  • Hypothetical subdomain takeovers without supporting evidence
  • "Exposed" login interfaces of third-party tools
  • Issues that are premised on an unlikely user interaction
  • Open redirection
  • Support chat file uploads
  • We are no longer issuing rewards for reports of potential GoCardless credentials leaked on third-party sites. We use other tools to continuously monitor the threat landscape for leaked credentials and other business-critical information about GoCardless and our customers. Further to that, upon every login, users' passwords are checked against a database of compromised passwords. You may still report these cases, but no bounty will be issued.

Safe Harbour

All activities conducted in a manner consistent with this policy will be considered authorised conduct, and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.