Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Moneytree KK

Bug bounty on Bugcrowd moneytree.jp

Accepting reports
Go to program
Top reward
$5,000
Top severity paid
Critical
Assets in scope
13
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays up to $5,000
for critical bugs, from $300.
Report on Bugcrowd
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
No public write-ups
Keep findings private.

Rewards

What Bugcrowd lists as the payout for each severity.

Severity Reward
Critical $5,000 from $4,000
High $3,000 from $2,000
Medium $1,000 from $750
Low $500 from $300
Earlier reward tables (1)
  • 11 Nov 2026 to 11 Nov 2026: Critical up to $5,000

Scope

13 assets you may test, 3 excluded.

Web 9

  • https://app-staging.getmoneytree.com
  • https://business-staging.getmoneytree.com
  • https://fitbit-lottery-staging.getmoneytree.com
  • https://myaccount-staging.getmoneytree.com
  • https://redash-staging.getmoneytree.com
  • https://vault-staging.getmoneytree.com
  • https://wwws-staging.moneytree.jp/link
  • https://wwws-staging.moneytree.jp/link/mobile
  • https://wwws-staging.moneytree.jp/link/mobile/#/signup?client_id=38d99a6e8e9fc87c866f5aa82bdc2569c464b2323a55e0b28f658efa678e9623&redirect_uri=https://wwws-staging.moneytree.jp/link/mobile/callback&response_type=token&scope=guest_read+accounts_read+transactions_read+request_refresh

APIs 2

  • https://jp-api-staging.getmoneytree.com
  • https://mcp-staging.getmoneytree.com

Android apps 1

  • https://play.google.com/store/apps/details?id=jp.moneytree.moneytree&hl=en_AU&gl=US

iOS apps 1

  • https://apps.apple.com/vc/app/moneytree-finance-made-easy/id586847189
Out of scope (3)
  • Any production asset of Moneytree KK (excepting the iOS app)
  • getmoneytree.com
  • moneytree.jp

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Moneytree KK (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.

While testing

  • please avoid pentesting against any domain that does not contain staging
  • Register your free accounts with your @bugcrowdninja email
  • You're free to upgrade your account with a Stripe testing account
  • Use the client_id provided in the scope URL to test any OAuth flow
  • Please, do not continue fuzzing after finding one of these
  • Researchers must provide a fully working non-malicious proof of concept that demonstrates a valid security impact in order to qualify for rewards
  • Do not register with another email than the Bugcrowd official one
  • Please make all reports confidentially via the Bugcrowd platform

Not accepted

  • No DMARC, nor SPF
  • CLIENT_ID is public
  • Android App has the “allowBackup” attribute enabled (and others) specifically just for testing
  • Do not register with another email than the Bugcrowd official one
  • Vulnerabilities that requires to physically access the mobile device and unblock it
  • Any Intercom related issues
  • Recommendations, best practices or anything without a proof of concept
  • Copy & pasted reports containing links from other customers
  • OAuth session token is not invalidated on logout or password change/reset
  • Delete account nor change password nor change email don't ask for old password
  • Server Security Misconfiguration | No Rate Limiting on Form | Login [as of 9:30 PM PT on 1/25/2018]
  • Server Security Misconfiguration | No Rate Limiting on Form | Registration [as of 9:30 PM PT on 1/25/2018]
  • Server Security Misconfiguration | No Rate Limiting on Form | Email-Triggering [as of 9:30 PM PT on 1/25/2018]
  • Anything related to "Moneytree Business" bypass trial or subscription override is a known issue
  • Free guests have historical data restrictions, but we are aware it can be bypassed by querying the API or using the web version

Summarised with AI from the program policy on Bugcrowd, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

  1. Scope −

    Removed from scope: https://fitbit-lottery.getmoneytree.com/

  2. Scope +

    Added to scope: https://fitbit-lottery-staging.getmoneytree.com/

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://mcp-staging.getmoneytree.com/

  2. Status

    Program status changed

  3. Status

    Program status changed

  4. Scope added

    Any production asset of Moneytree KK (excepting the iOS app) (out of scope)

  5. Scope added

    https://wwws-staging.moneytree.jp/link/mobile/#/signup?client_id=38d99a6e8e9fc87c866f5aa82bdc2569c464b2323a55e0b28f658efa678e9623&redirect_u...

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Description

Moneytree provides a personal finance management app that uses data aggregation to radically simplify your relationship with money. The service currently supports Japanese financial institutions and provides a Japanese & English language interface. This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization/rating of findings. NEW UPDATES TO OUT OF SCOPE TESTING ITEMS, PLEASE ADVISE

Targets

Any domain/property of Moneytree KK not listed in the targets section is out of scope. This includes any/all subdomains not listed above. For this program, we're inviting researchers test our staging platform, divided in: Devices: (a) ios and (b) android applications (a) https://itunes.apple.com/au/app/id586847189 (Production. Read note below!) (b) https://play.google.com/store/apps/details?id=jp.moneytree.moneytree (Production .apk Read note below!) Webclients: (a) general, (b) partners, (c) mobile and (d) oauth (a) https://app-staging.getmoneytree.com (b) https://wwws-staging.moneytree.jp/link/ (c) https://wwws-staging.moneytree.jp/link/mobile/ (d) https://wwws-staging.moneytree.jp/link/mobile/#/signup?client_id=38.. Regional API: (a) our main monolithic API (internally connects to several services) (a) https://jp-api-staging.getmoneytree.com Guest Service: OAuth (a) https://myaccount-staging.getmoneytree.com iOS is not friendly for hosting staging versions, so we shared the production link. However, while we allow the use of it to understand the navigation flow, please avoid pentesting against any domain that does not contain staging . Access There are no restrictions, but some rate-limits may apply. Credentials Register your free accounts with your @bugcrowdninja email . You're free to upgrade your account with a Stripe testing account. Ex: 4242424242424242 (any expiration date) Use the client_id provided in the scope URL to test any OAuth flow. Test Institutions can be used to simulate linking banks, credit card, or point accounts. To get to the test financial institution, when adding an account, select 'bank', and then 'test financial institution' - which will provide you with the options for a test bank/credit card/etc. Other test institutions can be used to simulate error states. 500 Internal Errors If you provoke any 500, we are going to receive an alert and fix it as soon as possible. Please, do not continue fuzzing after finding one of these. Note: Researchers must provide a fully working non-malicious proof of concept that demonstrates a valid security impact in order to qualify for rewards. Out-of-Scope No DMARC, nor SPF CLIENT_ID is public. However, there are other keys that are valid testing but please note this. - Android App has the “allowBackup” attribute enabled (and others) specifically just for testing. - Do not register with another email than the Bugcrowd official one Vulnerabilities that requires to physically access the mobile device and unblock it - Any Intercom related issues Recommendations, best practices or anything without a proof of concept Copy & pasted reports containing links from other customers OAuth session token is not invalidated on logout or password change/reset Delete account nor change password nor change email don't ask for old password Server Security Misconfiguration | No Rate Limiting on Form | Login [as of 9:30 PM PT on 1/25/2018] Server Security Misconfiguration | No Rate Limiting on Form | Registration [as of 9:30 PM PT on 1/25/2018] Server Security Misconfiguration | No Rate Limiting on Form | Email-Triggering [as of 9:30 PM PT on 1/25/2018] (NEW!) Anything related to "Moneytree Business" bypass trial or subscription override is a known issue (NEW!) Free guests have historical data restrictions, but we are aware it can be bypassed by querying the API or using the web version. Report any data leak We will immensely appreciate that you report all the information you reveal. Our customers deserve to be notified if their private information was shown without their consent. Please make all reports confidentially via the Bugcrowd platform.

Staging @ moneytree.jp (in scope)

All domains related to Moneytree K.K. on staging , including our web, android, and iOS applications.