- Top reward
- Not published
- Top severity paid
- Critical
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
HackerOne does not publish a reward table for this program.
- Response
-
Within 3 days
We will respond to your report as soon as we can (at least within 3 business days) with our evaluation of the report and an expected resolution date,
- Safe harbor
-
Full
If you have followed the instructions above, we will not take any legal action against you in regard to the report,
- Hall of fame
-
Yes
In the public information concerning the problem reported, we will give your name as the discoverer of the problem (unless you desire otherwise), and
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test.
Web 2
- moneybird.com Critical
- moneybirdstorage.com Critical
Android apps 1
- com.moneybird.android Critical
iOS apps 1
- com.moneybird.Moneybird Critical
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Moneybird (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability or deleting or modifying other people's data,
-
Do not reveal the problem to others until it has been resolved,
-
Do not use attacks on physical security, social engineering, brute force attacks, distributed denial of service, spam or applications of third parties, and
-
Do provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Status
Program status changed
-
Status
Program status changed
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Disclosure policy
At Moneybird, we consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present.
If you discover a vulnerability, we would like to know about it so we can take steps to address it as quickly as possible. We would like to ask you to help us better protect our customers and our systems.
Please do the following
- Do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability or deleting or modifying other people's data,
- Do not reveal the problem to others until it has been resolved,
- Do not use attacks on physical security, social engineering, brute force attacks, distributed denial of service, spam or applications of third parties, and
- Do provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation.
What we promise
- We will respond to your report as soon as we can (at least within 3 business days) with our evaluation of the report and an expected resolution date, If you have followed the instructions above, we will not take any legal action against you in regard to the report,
- We will handle your report with strict confidentiality, and not pass on your personal details to third parties without your permission,
- We will keep you informed of the progress towards resolving the problem, In the public information concerning the problem reported, we will give your name as the discoverer of the problem (unless you desire otherwise), and
- We strive to resolve all problems as quickly as possible, and we would like to play an active role in the ultimate publication on the problem after it is resolved.
This Responsible disclosure is based on the guidelines from NSCS written by Floor Terra.