Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

MercadoLibre

Bug bounty on HackerOne mercadolibre.com

Accepting reports Full safe harbor
Go to program Website
Top reward
$15,000
Top severity paid
Critical
Assets in scope
78
Public CVEs
1
Last change

At a glance

What to know before you start testing.

Pays up to $15,000
for critical bugs.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
Replies within 2 days
As the policy promises.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $15,000 from $4,500
High $10,000 from $3,500
Medium $500
Low $200
Response
Within 2 days **Time to First Response** (from report submission): 2 business days
Safe harbor
Full Mercado Libre does not intend to take legal action or initiate law enforcement investigations against security researchers who adhere to the following guidelines:

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

78 assets you may test, 9 excluded.

Web 44

  • api.mercadolibre.com Critical
  • api.mercadopago.com Critical
  • biolibre.ar Critical
  • biolibre.cl Critical
  • biolibre.co Critical
  • biolibre.mx Critical
  • biolivre.com.br Critical
  • fullbarhomologa.modoblackfullbar.com.br Critical No bounty
  • furycloud.io Critical
  • furydocs.io Critical
  • logistica.redelcom.cl Critical
  • meliplay.com.ar Critical
  • meliplay.com.pe Critical
  • meliplay.com.uy Critical
  • mercadobackoffice.com Critical
  • mercadoenvios.com.ve Critical No bounty
  • mercadolivreexperience.mercadolivre.com.br Critical No bounty
  • mercadopago.com.ve Critical
  • mercadoplay.co Critical
  • mercadoplay.com.pe Critical
  • mercadoplay.com.uy Critical
  • mercadoplay.pe Critical
  • mercadoplay.uy Critical
  • mpago.la Critical
  • mpago.li Critical
  • portalinmobiliario.cl Critical
  • portalinmobiliario.com Critical
  • sustentabilidadmercadolibre.com Critical
  • tucarro.com Critical
  • tucarro.com.co Critical
  • tumoto.com Critical
  • www.ipbooster.com Critical No bounty
  • www.mercadolibre.co.cr Critical
  • www.mercadolibre.com.bo Critical
  • www.mercadolibre.com.do Critical
  • www.mercadolibre.com.ec Critical
  • www.mercadolibre.com.gt Critical
  • www.mercadolibre.com.hn Critical
  • www.mercadolibre.com.ni Critical
  • www.mercadolibre.com.pa Critical
  • www.mercadolibre.com.py Critical
  • www.mercadolibre.com.sv Critical
  • www.mercadolivre.com Critical
  • www.mercadopago.com.ec Critical

Wildcard domains 22

  • *.adminml.com Critical
  • *.mercadolibre.cl Critical
  • *.mercadolibre.com Critical
  • *.mercadolibre.com.ar Critical
  • *.mercadolibre.com.co Critical
  • *.mercadolibre.com.mx Critical
  • *.mercadolibre.com.pe Critical
  • *.mercadolibre.com.uy Critical
  • *.mercadolibre.com.ve Critical No bounty
  • mercadolibreexperience.com.* Critical No bounty
  • *.mercadolivre.com.br Critical
  • *.mercadopago.cl Critical
  • *.mercadopago.com Critical
  • *.mercadopago.com.ar Critical
  • *.mercadopago.com.br Critical
  • *.mercadopago.com.co Critical
  • *.mercadopago.com.mx Critical
  • *.mercadopago.com.pe Critical
  • *.mercadopago.com.uy Critical
  • *.mlstatic.com Critical
  • *.modoblack.mercadolivre.com.br Critical No bounty
  • *.tucarro.com.ve Critical No bounty

Android apps 6

  • com.mercadoenvios.crowdsourcing Critical
  • com.mercadoenvios.driver Critical
  • com.mercadoenvios.logistics Critical
  • com.mercadolibre Critical
  • com.mercadolibre.android.mplay_tv Critical
  • com.mercadopago.wallet Critical

iOS apps 2

  • com.3mosquitos.MercadoLibre Critical
  • com.mercadopago.MercadoPago Critical

Hardware and IoT 1

  • Point Smart Critical

Products and areas 3

  • Crypto Critical
  • Tier 3 Critical
  • Wonder Critical
Out of scope (9)
  • developersforum
  • Redelcom
  • wow-int.mercadolibre.com
  • *.gokangu.cl
  • *.gokangu.co
  • *.gokangu.mx
  • *.gokangu.uy
  • *.kangu.com.br
  • *.kangu.tech

Rules

What the policy asks of you, and the bug types it won't reward, quoted from MercadoLibre (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Massive automated scans are not permitted.
  • Improper or out-of-scope use of test users may result in a ban from the program.
  • Significantly degrading our service may lead to a ban from the program.
  • Denial-of-Service (DoS) activities are prohibited by our cloud providers.
  • Physical attacks against MercadoLibre employees, offices, or data centers are prohibited.
  • Engaging in social engineering of Mercado Libre employees, contractors, vendors, or service providers, including phishing, is not allowed.
  • Pursuing vulnerabilities that involve sending unsolicited bulk messages (spam) is prohibited.
  • Attempting to gain access to another user's account or data by compromising a MercadoLibre customer or employee account is forbidden.
  • Mass account creation for testing against Mercado Libre applications and services is not allowed.
  • "Brute force" testing to determine rate limiting for APIs or other functionalities is prohibited.

Not accepted

  • Certificate pinning and SSL/TLS best practices for native apps.
  • Obfuscated code in native apps.
  • Exported components with no real security impact on native apps.
  • Dependency confusion vectors are out-of-scope.
  • Use of out-of-date third-party libraries without proof of exploitability is out-of-scope.
  • Vulnerabilities in third-party scripts used on Mercado Libre's websites are out-of-scope.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 44 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope removed

    Leaked Credentials

  2. Scope added

    mercadolivreexperience.mercadolivre.com.br

  3. Scope added

    fullbarhomologa.modoblackfullbar.com.br

  4. Scope added

    modoblack.mercadolivre.com.br

  5. Scope added

    Wonder

  6. Scope removed

    mercadolibreexperience.cl

  7. Scope added

    mercadolibreexperience.com.*

  8. Scope removed

    mercadolivreexperience.com.br

  9. Scope added

    *.mercadolibre.com.ve

  10. Scope added

    *.tucarro.com.ve

  11. Scope added

    www.ipbooster.com

  12. Scope added

    academy.mercadoads.com

  13. Scope added

    mercadobackoffice.com

  14. Scope added

    mercadopago.com.ve

  15. Scope added

    mpago.la

  16. Scope added

    mpago.li

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2014-5658 Medium 5.4 9 Sep 2014

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Table of Contents

Current Active Challenge

Name Documentation
ATO 2FA BYPASS F4018599
CSP BYPASS F4286645

Rewards

MercadoLibre offers rewards to eligible reporters for qualifying vulnerabilities, with a minimum reward of $50 USD. The bounty table specifies minimum rewards based on the assessed CVSS score for in-scope properties. We reserve the right to adjust rewards based on specific impact.

All bounties for High and Critical reports are calculated using CVSS 3.1.

  • For high and critical reports the bounty is determined by this formula:

(((CVSS Score × Tier) × Severity) + Loyalty Bonus) = Bounty total

Example Calculation
CVSS 8,6 (High), Tier 1 & 5 years hacker ((8,6 × 100) × 10) = $8,600 base + $860 Antique bonus (10%) = $9,460
CVSS 8,6 (High), Tier 2 & 5 years hacker ((8,6 × 50) × 10) = $4,300 base + $430 Antique bonus (10%) = $4,730

This is calculated with constants that are:

Description Constant
TIER 1 100
TIER 2 50
HIGH/CRITICAL 10
  • For lows and mids reports the bounty is fixed as specified in the bounty table.
  • The bounty table ranges represent the maximum cap for the base bounty. Bonuses and the Fix Bypass addition are calculated on top of and may exceed the published bounty table ranges.
  • Low vulnerabilities will only be paid if CVSS score >= 2.0.
  • Bounty decisions are made by an internal team who consider several factors, including CVSS scores, involvement of customer data, severity of the vulnerability, compliance with the HackerOne standard, and the affected business unit.
  • Reports that demonstrate a high level of technical skill and clarity may also be considered when determining the final bounty range.
  • Bounties are set according to our current payout table.
  • The value of bounties awarded for previous vulnerabilities does not set a precedent for future cases.

Loyalty, gamification and bonus

Bonus Name Description Reward
Newbie If this is your first valid report on our program, you get a bonus 25% on the total bounty
Antique An extra percentage bonus over the bounty for consecutive years reporting on the program 2 years = 4% / 3 years = 6% / 4 years = 8% / 5 years and more = 10%
Fix Bypass If you report a valid bypass over a previously fixed vulnerability +10% added to the total bounty

Bonus Restrictions:

  • The Antique bonus applies to consecutive years only.
  • Bonuses are retroactive to the current year.
  • The Newbie bonus can only be claimed in 1 report per year.
  • The Newbie and Antique bonuses are mutually exclusive — only one applies per report.
  • The Fix Bypass addition is independent and stacks on top of the base bounty, regardless of whether a Newbie or Antique bonus also applies.
  • Bonuses are only paid on reports in "triage" or "resolved" status.
  • The Antique (Loyalty) bonus applies to Tier 3 reports and multiplies the fixed bounty amount. The Newbie bonus and Fix Bypass addition do not apply to Tier 3 reports.

Tier 3 Non Applicative Vulnerabilities

This section covers security findings resolved through configuration changes, access revocation, or asset remediation — not through a code pull request. Tier 3 was introduced to provide a clear bounty path for exposure scenarios that fall outside Tier 1 / Tier 2 but carry demonstrable business risk.

What qualifies as Tier 3

A report is eligible for Tier 3 when all of the following conditions are met:

  1. The finding is non-applicative. The exposure is caused by a misconfiguration, an access control gap, or an asset management failure — not by a vulnerability in application code. Typical examples: leaked credentials or API tokens in a public repository, internal documents exposed on a public drive or paste site, misconfigured cloud storage buckets or dashboards with PII.

  2. The asset is demonstrably linked to MercadoLibre. The exposed material must be verifiably owned, managed, or created by current MercadoLibre employees acting within the scope of their role or hosted in official MercadoLibre scopes. This includes:

    • Official @mercadolibre / @mercadolivre accounts on any platform.
    • Assets found in MercadoLibre scopes.
    • Personal GitHub, Google Drive, or similar accounts of current employees, provided the reporter can demonstrate a direct link to their MercadoLibre role (e.g., corporate email in commit history, internal system references, cross-links to MELISOURCE).

  3. The fix is a configuration or access change, not a code patch.

  4. No exploitation beyond confirmation. The reporter must not have accessed, exfiltrated, or used the exposed data beyond confirming its existence. Demonstrating credential validity via a single, non-destructive API call is acceptable; going further is not.

5.Integrator Users : We will not accept any reports from this type of user, they are third-party developers.

Severity criteria

Tier 3 reports are not scored with CVSS. Severity is assessed by the MercadoLibre team based on the CIA impact (Confidentiality / Integrity / Availability) of the exposed asset and the sensitivity of the data involved.

Tier 3 Severity Bounty (USD)
Critical $1,000
High $750
Medium $200
Low $75

One bounty per source

Tier 3 pays one bounty per source location, regardless of the number of credentials or records found within it. The bounty severity is determined by the MercadoLibre team based on the highest-impact item present in that source.

Reporting guidelines

To help us triage your Tier 3 report efficiently, please include:

  • Source location: URL or path of the exposed asset (e.g., GitHub repo, Google Drive link, cloud storage URL).
  • Ownership evidence: explain how the asset is linked to MercadoLibre (commit author email, internal system references, etc.).
  • Credential/document validity: confirm whether the secret was active at time of discovery. A single non-destructive validation call is sufficient — do not go further.

Response Times

Mercado Libre is committed to making a best effort to meet the following response times for hackers participating in our program:

  • Time to First Response (from report submission): 2 business days
  • Time to Triage (from report submission): 5 business days
  • Time to Bounty (from triage): 10 business days

We will keep you informed about our progress throughout the process.

If you have any questions can contact us on our discord

Testing

Please note that for any vulnerability reported using these accounts, the Privileges Required (PR) metric in the CVSS calculator will consistently be rated as HIGH, as these users are provisioned specifically for security research.

  • Test cards: You can use test cards of local payment methods and simulate different payment responses, without the need to use a real card. Depending on your country, use one of the credit or debit cards we provide.

Eligibility and Responsible Disclosure

To promote coordinated disclosure, Mercado Libre does not intend to take legal action or initiate law enforcement investigations against security researchers who adhere to the following guidelines:

  • Researchers must report discovered security issues to Mercado Libre without making any information or details public until a mutual agreement is reached or with explicit authorization from MercadoLibre.
  • Researchers should allow Mercado Libre reasonable time to resolve the issue before publishing any information or details about the vulnerability. Mercado Libre commits to following the HackerOne disclosure guidelines, ensuring open communication, providing an initial response to the researcher within 30 days, and mutually agreeing on a disclosure timeline.
  • Researchers should make all reasonable efforts in good faith to avoid destroying, stealing, modifying, damaging, or otherwise jeopardizing the personal data or privacy of Mercado Libre's customers or data. This includes avoiding any disruption to Mercado Libre's products and services.

Restrictions

The following actions are expressly prohibited and are not covered under the Coordinated Disclosure Policy:

  • Automated Scanning: Massive automated scans are not permitted. Creative testing is encouraged instead.
  • Test Users: Improper or out-of-scope use of test users may result in a ban from the program.
  • Service Degradation: Significantly degrading our service may lead to a ban from the program.
  • No DoS Attacks: Denial-of-Service (DoS) activities are prohibited by our cloud providers.
  • Physical Attacks: Physical attacks against MercadoLibre employees, offices, or data centers are prohibited.
  • Social Engineering: Engaging in social engineering of Mercado Libre employees, contractors, vendors, or service providers, including phishing, is not allowed.
  • Spam: Pursuing vulnerabilities that involve sending unsolicited bulk messages (spam) is prohibited.
  • Account Compromise: Attempting to gain access to another user's account or data by compromising a MercadoLibre customer or employee account is forbidden.
  • Malware: Knowingly posting, transmitting, uploading, linking to, or sending malware to Mercado Libre or its employees is prohibited.
  • Mass Account Creation: Mass account creation for testing against Mercado Libre applications and services is not allowed.
  • Brute Force Testing: "Brute force" testing to determine rate limiting for APIs or other functionalities is prohibited.
  • Employee Participation: Internal employees are prohibited from participating in this program.
  • Former Employees: Former employees may participate only after a one-year waiting period from their termination date.
  • Provider Participation: Participation from our providers, including individuals or entities directly affiliated with Mercado Libre, is strictly prohibited.
  • Vulnerabilities, misconfigurations, or security flaws discovered in the MercadoPago integrations SDK and secure inputs, or any related subdomains/endpoints, are not eligible for bounty, but will be eligible for reputation points.

Considerations

a. Considerations on Issues Related to Vulnerabilities Found in Code Review Exercises or SAST:

  • Please avoid uploading automatic scanning tool results.
  • 0-day and other CVE vulnerabilities may be reported 30 days after initial publication (CVE List Status of Published).
  • Vulnerabilities related to exploitable dependencies, CVEs, 0-days, and working exploits must be demonstrable through the internet with a proper PoC.
  • Dependency confusion vectors are out-of-scope.
  • Supply chain attacks involving a malicious package that is verifiably published in a public registry and demonstrably affects MercadoLibre's build or runtime environment are in-scope and must include a working PoC.

b. Considerations on Issues Related to Vulnerabilities Found in Third-Party Applications Used by Mercado Libre:

  • If the vulnerability is found in a third-party application used by MercadoLibre, it must be exploitable on Mercado Libre's infrastructure to be considered valid. Otherwise, it will be marked as informative.
  • Use of out-of-date third-party libraries without proof of exploitability is out-of-scope.
  • Vulnerabilities in third-party scripts used on Mercado Libre's websites are out-of-scope.

c. Considerations for Mobile Applications:

The following issues specific to mobile applications should not be tested or reported:

  • Certificate pinning and SSL/TLS best practices for native apps.
  • Obfuscated code in native apps.
  • Use of SafetyNet attestation API or similar tools to protect against anti-dynamic instrumentation, debugging, emulation, tampering, or root detection in native apps.
  • Exported components with no real security impact on native apps.
  • Vulnerabilities related to loading arbitrary domains on the following deeplinks:
    • mercadopago://in-app-browser/?url=$URL
    • meli://in-app-browser/?url=$URL
    • The In-App Browser feature is designed to open external web pages through deep links directly from the app without breaking its flow. Therefore, any external website opened in the in-app browser is treated as an untrusted domain.

d. Considerations on Issues Related to Subdomain Takeover:

  • It must be possible to insert content.
  • Demonstrate control with a verification page, DNS evidence (CNAME/A), provider, and claim steps; HTTP/HTTPS response captures.
  • Do not steal cookies or interact with users; no phishing.

e. Other Considerations:

  • Cross-site scripting vulnerabilities without a Content Security Policy (CSP) bypass will be assessed with a lower or no severity level compared to those with a bypass.
  • We reserve the right to establish the severity of vulnerabilities based on their direct impact on MercadoLibre; therefore, the severity may increase or decrease depending on the case.
  • Mercado Libre team may also determine if a vulnerability is a duplicate of either a previous report in our bug bounty program or an internal report submitted by a collaborator.
  • Reports that contain inappropriate or disrespectful language towards any of the triagers of HackerOne or Mercado Libre staff will be closed as N/A. Repeated offenses may result in a ban from the program.
  • Any .cn domain, such as *.mercadolibre.cn, is excluded from the scope.

Mercadolibre reserves the right to modify this program at any time.

Mercadolibre reserves the right to evaluate the scope tiers at any time.

MercadoLibre reserves the right to escalate a Tier 3 finding to Tier 2 or Tier 1 based on the assessed business impact of the vulnerability.

Thank you for helping to keep Mercado Libre and our customers safe!