- Top reward
- $15,000
- Top severity paid
- Critical
- Assets in scope
- 32
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $15,000
- for critical bugs.
- Report through their form
- hackerone.com/grab
- Partial safe harbor
- Some legal protection; read the terms.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$15,000 from $5,000 |
| High |
|
$7,500 from $2,000 |
| Medium |
|
$3,000 from $500 |
| Low |
|
$750 from $50 |
- Safe harbor
-
Partial
Making an effort in good faith by ensuring that there is no leak, manipulation, alteration, modification and/or destruction, in whatsoever manner, to any of user data and Grab proprietary data.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
32 assets you may test, 1 excluded.
Web 9
- api.grabpay.com Critical
- gamma.grab.co Critical
- gifts.grab.com Critical
- grab.careers Medium
- hungrygowhere.com High
- kartaview.org Medium
- manage.grab.co Critical
- p.grabtaxi.com Critical
- xtramile.grabpay.com Critical
Wildcard domains 9
- *.grab.co Medium
- *.grab.com Critical
- *.grabpay.com Critical
- *.grab-sure.com Critical
- *.grabtaxi.com Medium
- *.myteksi.com Critical
- *.myteksi.net Critical
- *.ovofinansial.com Critical
- *.ovo.id High
Android apps 6
- com.grab.merchant Critical
- com.grabpay.merchant Medium
- com.grabtaxi.driver2 Critical
- com.grabtaxi.passenger Critical
- com.moveit.app.customer Critical
- ovo.id Critical
iOS apps 5
- 1142114207 Critical
- 1257641454 Critical
- 1343620481 Medium
- 1481198245 Critical
- 647268330 Critical
Products and areas 3
- C100447517 Critical
- C103149579 Critical
- Cloud & 3rd-Party Services (First-Party Misconfigurations) Critical
Out of scope (1)
- *.qms.grab.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Grab (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please only test against accounts you own yourself or with the explicit permission of the account holder.
-
Please refrain from automated/scripted account creation.
-
In the events of a possible bulk enumeration of customer data, refrain from harvesting a large amount of information, a small sample is enough as a proof of concept.
-
Please use HackerOne registered accounts <username>@wearehackerone.com addresses or identify yourself by providing your HackerOne username.
-
Include a custom HTTP header in all your traffic.
-
Please report to us what data was accessed and delete the data accordingly.
-
Do not save, copy, download, transfer, or disclose the data found, and please delete any files that may contain the data from your devices after the vulnerability has been validated.
-
Do not attempt any intrusive actions that could compromise the integrity and functionality of our LLM systems.
-
Respect the boundaries of your testing activities.
-
Always make an effort in good faith to protect our LLM systems and data.
Not accepted
-
Descriptive error messages that do not reveal any sensitive information (e.g. Stack Traces, application or server errors).
-
Exposure of third-party API keys with no significant security impact (eg. Google Maps API, Sentry keys).
-
Open redirects.
-
Out-of-date software without demonstration of significant security impact.
-
Mis-configured host header with no significant security impact.
-
Broken Link Hijacking with no significant security impact.
-
Disclosure of known public files or directories, (e.g. robots.txt).
-
Clickjacking/Tapjacking issues without working POC and without demonstrating a significant security impact.
-
Comma Separated Values (CSV) injection without demonstrating a significant security impact.
-
Issues with prerequisite of MITM, physical or remote access to a victim's authenticated session.
-
Cross-site Request Forgery with no significant security impact.
-
Lack of cookie flags on non-sensitive cookies.
-
Issue related to HTTP "OPTIONS" method.
-
Content spoofing/text injection
-
Issues exploitable only on outdated browsers.
-
Best practice concerns without demonstrating an exploitable vulnerability.
-
Reverse Tabnabbing related issues.
-
Missing HTTP security headers with no significant security impact.
-
Issues related to weak TLS/SSL versions & ciphers.
-
Mail server misconfiguration, spoofing, SPF, DMARC, etc.
-
Server misconfiguration issues (i.e., open ports, TLS, etc.)
-
Most vulnerabilities within our sandbox, uat, or staging environments.
-
Vulnerability requiring installation or use of 3rd party apps/ tools/ plugins for successful exploitation.
-
Issues with a prerequisite of phishing or controlling a victim's email account, social media accounts, etc.
-
Most issues requiring brute force.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 4 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
Cloud & 3rd-Party Services (First-Party Misconfigurations)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Foreword
Security is a top priority at Grab. We believe that no technology is perfect and that working with skilled security researchers across the globe is crucial in identifying weaknesses in our technology.
If you believe you've found a security bug in our service, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery.
Coordinated disclosure rules
Please let us know as soon as possible upon discovery of a potential security issue, and we’ll make every effort to quickly correct the issue if it is found to be valid. You may not disclose any information about the issue outside of the program unless you receive explicit written consent from the Grab team.
Making an effort in good faith by ensuring that there is no leak, manipulation, alteration, modification and/or destruction, in whatsoever manner, to any of user data and Grab proprietary data. Please only test against accounts you own yourself or with the explicit permission of the account holder. Please refrain from automated/scripted account creation. In the events of a possible bulk enumeration of customer data, refrain from harvesting a large amount of information, a small sample is enough as a proof of concept.
By participating in this program, you agree to be bound by these rules.
Rewards
Grab will only issue monetary rewards for reports demonstrating meaningful impact. This means, for example, that we will issue a relatively high reward for a vulnerability that has the potential to leak sensitive user data, but that we will issue little to no reward for a vulnerability that allows an attacker to deface a micro-site.
For this reason, we strongly encourage researchers to spend extra time to provide a realistic attack/threat scenario adapted to our business. This will increase the chance of receiving a higher bounty.
The following table outlines some example scenarios of vulnerabilities for in-scope assets. Note that all amounts listed in the Rewards section are the maximum we can pay for each issue based on their severities. All final decisions are at the discretion of Grab.
We try our best to cycle bounty payouts on Fridays.
| Severity | Examples (inspired from previous reports) |
|---|---|
| Critical | RCE on a Production server, Bulk personally identifiable information (PII) exposure [^], Access to source code |
| High | Restricted or limited account takeover, Vertical/horizontal privilege escalations, Authorization checks bypass allowing fraudulent transactions |
| Medium | SSRF without clear impact demonstration, Business logic error with monetary impact |
| Low | Stored/Reflected XSS with low impact (no sensitive data exfiltrated), Exposed logs without sensitive information, Exposed API keys with low privileges |
| None | Duplicate, N.A, Informational bug(s) |
~ Bounty payout range table (all amounts are in USD) ~
-
Note that Asset severity can be used as a weightage for calculating the final bounty amount (please refer to the Scope section for more details).*
-
[^] Including but not limited to: customer/driver name, email, address, IC number, driver photos, license plate numbers, location information, or payment card information (PCI) like credit card numbers, bank account numbers, etc.*
Information Disclosure and Reward Policy Grab values the contributions of security researchers in identifying vulnerabilities and safeguarding our platform. To ensure responsible reporting and fair recognition, the following guidelines apply to information leakage disclosures: -Reports on information leakage involving actual employee domain accounts are typically rewarded with a token of appreciation of $50 USD for each unique case. For other types of cases, rewards will be determined at our discretion.
Note: Grab reserves the right to award bounties for cases demonstrating substantial impact.
-
Most information leakage issues are classified under Low Severity unless researchers can demonstrate a clear and significant impact. Examples of low-severity issues include, but are not limited to: 1. Leakage of non-sensitive public-facing information. 2. Discovery of outdated credentials or tokens that are no longer in use. 3. Misconfigured storage buckets containing non-sensitive data.
-
To ensure ethical and responsible disclosure, researchers are required to:
- Provide source around how the leaked information was obtained.
- Submit leaked credentials directly to Grab, refraining from testing their validity beyond authentication and immediately logging out, without engaging in any functionality.
-
Any unauthorized exploitation or misuse of leaked information is strictly prohibited and may result in disqualification from the program.
Notes
- Please note that if a single fix is able to resolve multiple vulnerabilities, usually due to the same root cause, it will be rewarded as a single bounty on one report, determined by its overall impact.
- For quality reports that prove significant impact on the Grab business, are well-written, display an innovative approach in testing and where the reporter demonstrates a professional attitude, Grab may award a maximum of $2,000 bonus on top of the original bounty amount. Decisions to award a bonus for a report is at our discretion.
Report Eligibility
Grab reserves the right to decide if the minimum severity threshold is met and whether it was previously reported. To qualify for a reward under this program, you should:
- Be the first to report a specific vulnerability.
- Send a clear textual description of the report along with steps to reproduce the vulnerability. Include attachments such as screenshots or proof of concept code as necessary.
- Disclose the vulnerability report directly and exclusively to us. Please do not disclose (public disclosure or disclosure to other third parties- including vulnerability brokers) information about the issue or your report without explicit written consent from the Grab Team.
- For all **other **disclosure guidelines (except for the disclosure of Grab issues mentioned above), please refer to HackerOne's Vulnerability Disclosure Guidelines.
- This program is open and accessible to external researchers only; any employees (full time, part time, on fixed term contracts), contractors and certain service providers of Grab or its affiliates, sister companies or associate companies shall be ineligible for this program. This exclusion shall be effective retrospectively. Grab reserves the right to initiate disciplinary proceedings against any individual who breaches this section and may demand a clawback for any rewards paid out in contravention of this section.
- Please report to us what data was accessed and delete the data accordingly. Do not save, copy, download, transfer, or disclose the data found, and please delete any files that may contain the data from your devices after the vulnerability has been validated.
Known issues
Please note that the Grab Security Team also actively looks for vulnerabilities across all assets internally. For reported issues that are already known to us, we will close them as duplicates. We seek your kind cooperation to respect our final decision and to refrain from making multiple negotiations once the decision has been made.
Acquisitions
Newly acquired sites undergo an initial blackout period of sixteen-months. While we greatly appreciate any bug reports submitted earlier, they will not be eligible for rewards during this period.
Note : For Mergers and Acquisitions (M&A) until explicitly listed in the scope section, we will only accept reports of critical and high-severity bugs . These reports may be considered for bounty rewards at the discretion of our security team, who will assess severity and reward amounts.
Our primary goal is to assess and address all reported vulnerabilities to enhance the safety of our platform. We highly value your patience and cooperation during this phase.
Recently disclosed 0-day vulnerabilities
We need time to patch our systems just like everyone else - please give us two months before reporting these types of issues. We will appreciate anyone raising awareness for new CVEs but such reports will not qualify for a reward either.
Vulnerabilities found in third-party/vendors
Vulnerabilities affecting assets not listed as part of Grab's scope are not eligible for a bounty. If you find a vulnerability in a vendor or third-party that directly affects Grab, we will accept it and work with the third party on a best-effort basis to remediate the issue. However, in certain exceptional cases, if we decide to reward, the decision will be at our discretion.
Vulnerability found in LLM Models:
As we continue to innovate and integrate advanced technologies into our services, we recognize the potential for new types of vulnerabilities. This includes those related to Language Learning Models (LLM). For any Vulnerability related to LLM's please adhere to below guidelines:
-
Do not attempt any intrusive actions that could compromise the integrity and functionality of our LLM systems. This includes, but is not limited to, data poisoning and unauthorized data deletion.
-
Respect the boundaries of your testing activities. Any actions that could potentially harm our LLM systems or lead to unintended consequences are strictly prohibited.
-
Always make an effort in good faith to protect our LLM systems and data. This includes ensuring that there is no leak, manipulation, alteration, modification, or destruction of any data related to our LLM systems.
Community Platforms and Content Processing
Grab operates platforms where content is submitted by community contributors and processed before public availability.
- In scope: Security issues or systemic flaws caused by misconfigurations
- Out of scope: False negatives or detection misses resulting from the limitations of machine learning and computer vision models operating on a best-effort basis
Test Plan
Grab core properties and other assets usually experience a large amount of data traffic everyday. During testing, kindly make sure to include a custom HTTP header in your requests so you can make it easier for us to determine activities that belong to the HackerOne community against our normal data and the malicious actors out in the world. Please do add the following when participating and submitting reports to the Grab program:
- Please use HackerOne registered accounts @wearehackerone.com addresses or identify yourself by providing your HackerOne username.
- Include a custom HTTP header in all your traffic. Kindly add what header you use in the report template so we can identify it easily.
| Identifier | Format | Examples |
|---|---|---|
| Username | X-Bug-Bounty:HackerOne- | X-Bug-Bounty:HackerOne-Th3Guardian |
| Testing Timestamp | X-Bug-Bounty:Timestamp- | X-Bug-Bounty:Timestamp-01-09-2022 23:49 |
Please always keep in mind and remember to abide by all program rules. To mitigate potential damage, stop further testing, report the matter to Grab and HackerOne immediately, and delete any related program data under your care.
Out-of-Scope Vulnerabilities
This section contains issues that are not accepted under this program, because they are malicious and/or because they have a low-security impact and will be immediately marked as invalid.
The following findings are specifically excluded from the bounty:
- Descriptive error messages that do not reveal any sensitive information (e.g. Stack Traces, application or server errors).
- Exposure of third-party API keys with no significant security impact (eg. Google Maps API, Sentry keys).
- Open redirects. For the rare cases where the impact is higher, e.g. If you can leverage the open redirect to steal any sensitive information, perform an unauthorized action, chain with another vulnerability to bypass any restriction, etc., we do still want to hear about them.
- Out-of-date software without demonstration of significant security impact.
- Mis-configured host header with no significant security impact.
- Broken Link Hijacking with no significant security impact.
- Disclosure of known public files or directories, (e.g. robots.txt).
- Clickjacking/Tapjacking issues without working POC and without demonstrating a significant security impact.
- Comma Separated Values (CSV) injection without demonstrating a significant security impact.
- Issues with prerequisite of MITM, physical or remote access to a victim's authenticated session.
- Cross-site Request Forgery with no significant security impact.
- Lack of cookie flags on non-sensitive cookies.
- Issue related to HTTP "OPTIONS" method.
- Content spoofing/text injection
- Issues exploitable only on outdated browsers.
- Best practice concerns without demonstrating an exploitable vulnerability.
- Reverse Tabnabbing related issues.
- Missing HTTP security headers with no significant security impact.
- Infrastructure vulnerabilities, including:
- Issues related to weak TLS/SSL versions & ciphers.
- Mail server misconfiguration, spoofing, SPF, DMARC, etc.
- Server misconfiguration issues (i.e., open ports, TLS, etc.)
- Most vulnerabilities within our sandbox, uat, or staging environments.
- Vulnerability requiring installation or use of 3rd party apps/ tools/ plugins for successful exploitation.
- Issues with a prerequisite of phishing or controlling a victim's email account, social media accounts, etc.
- Most issues requiring brute force.
- Denial of service.
- Spamming.
- Insufficient rate limiting.
- Disclosure of private IP addresses or domains pointing to private IP addresses.
Out of Scope bugs for Android apps
- Any URIs leaked because a malicious app has permission to view URIs opened
- Absence of certificate pinning
- Sensitive data in URLs/request bodies when protected by TLS
- User data stored unencrypted on external storage
- Lack of obfuscation is out of scope
- Crashes due to malformed Intents sent to exported Activity/Service/BroadcastReceiver (exploiting these for sensitive data leakage is commonly in scope)
- Any kind of sensitive data stored in-app private directory
- Lack of binary protection control in the android app
- Runtime hacking exploits using tools like but not limited to Frida/ Appmon (exploits only possible in a jailbroken environment)
Out of Scope bugs for iOS apps
- Lack of Exploit mitigations i.e., PIE, ARC, or Stack Canaries
- Absence of certificate pinning
- Path disclosure in the binary
- User data stored unencrypted on the file system
- Lack of obfuscation is out of scope
- Lack of jailbreak detection is out of scope
- Crashes due to malformed URL Schemes
- Lack of binary protection (anti-debugging) controls
- Snapshot/Pasteboard leakage
- Runtime hacking exploits using tools like but not limited to Frida/ Appmon (exploits only possible in a jailbroken environment)
Please note that the rules, rewards, and assets in this Policy Page (https://hackerone.com/grab) precedes all previous versions and updates that may have been made in the past. All final decisions are at the discretion of Grab.
We are looking forward to seeing your reports, Happy hunting !
🚗 Grab Application Security Team 🚗