Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

OLAcabs

By ANI Technologies Private Limited Bug bounty on Self-hosted olacabs.com

Accepting reports
Go to program Website
Top reward
Not published
Top severity paid
Not published
Assets in scope
40
Public CVEs
0
Last change

At a glance

What to know before you start testing.

Pays cash
Amounts are not published; ask before you invest time.
Report by email
https://whitehat.olacabs.com/report
No safe harbor
No promise about legal action.
No public write-ups
Keep findings private.

Rewards

What the company's own policy page says it pays.

The policy page has no reward table. Here is what it says, in its own words.

Lowest reward
₹1,000 The minimum monetary reward for eligible bugs is 1000 INR.
Pays cash
Yes We offer monetary rewards for security issues which meet the following criteria:
Hall of fame
Yes Apart from monetary benefits, vulnerability reporters who work with us to resolve security bugs in our products will be honored on the Hall of Fame page.

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

40 assets you may test, 3 excluded.

Android apps 14

  • https://play.google.com/store/apps/details?hl=en&id=com.olacabs.customer
  • https://play.google.com/store/apps/details?hl=en&id=com.olacabs.olamoney
  • https://play.google.com/store/apps/details?id=com.app.krutrim.prod
  • https://play.google.com/store/apps/details?id=com.olacabs.android.operator
  • https://play.google.com/store/apps/details?id=com.olacabs.lite
  • https://play.google.com/store/apps/details?id=com.olacabs.oladriver
  • https://play.google.com/store/apps/details?id=com.olaelectric.companion
  • Ola Cabs mobile app ( Android | iOS )
  • Ola Electric mobile app ( Android | iOS )
  • Ola Krutrim mobile app ( Android )
  • Ola Lite mobile app - Lighter version of Ola Cabs app ( Android )
  • Ola Money mobile app ( Android | iOS )
  • Ola Operator mobile app ( Android )
  • Ola Partner mobile app ( Android | iOS )

Domains 9

  • mission-electric.in
  • olacabs.com
  • olaelectric.com
  • olaelectric.in
  • ola.foundation
  • ola.institute
  • olakrutrim.com
  • olamaps.io
  • olamoney.com

Wildcard domains 9

  • *.mission-electric.in
  • *.olacabs.com
  • *.olaelectric.com
  • *.olaelectric.in
  • *.ola.foundation
  • *.ola.institute
  • *.olakrutrim.com
  • *.olamaps.io
  • *.olamoney.com

iOS apps 8

  • https://apps.apple.com/au/app/ola-driver/id1351932840
  • https://apps.apple.com/in/app/ola-electric/id1537809074
  • https://itunes.apple.com/in/app/ola-cabs-book-taxi-one-touch!/id539179365?mt=8
  • https://itunes.apple.com/in/app/ola-money-smartest-way-to/id1064900603?mt=8
  • Ola Cabs mobile app ( Android | iOS )
  • Ola Electric mobile app ( Android | iOS )
  • Ola Money mobile app ( Android | iOS )
  • Ola Partner mobile app ( Android | iOS )
Out of scope (3)
  • All external services/software which are not managed or controlled by Ola are considered as out of scope / ineligible for recognition.
  • All the sandbox and staging environments are out scope.
  • Newly acquired company websites/mobile apps are subject to a 12 month blackout period.

Rules

What the policy asks of you, and the bug types it won't reward, quoted from OLAcabs's policy. "We" in these lines means the program, not this site.

While testing

  • You will not publicly or otherwise disclose any information regarding a bug or security incident without Ola’s prior approval.
  • You will not access any data/internal resources of Ola as well as the data of our customers without prior approval from the Ola security team.
  • You must be respectful to our existing applications, and in any case you should not run test-cases which might disrupt our services.
  • Do not use scanners or automated tools to find vulnerabilities since they’re noisy.
  • We also request you not to attempt attacks such as social engineering, phishing etc.
  • You may only investigate, or target vulnerabilities against your own account.
  • Testing should not violate any law, or disrupt or compromise any data or access data that does not belong to you.
  • Researchers must destroy all artifacts created to document vulnerabilities (POC code, videos, screenshots) after the bug report is closed.
  • You must not use any automated tools/scripts as those can be disruptive or cause systems to misbehave, doing so will invalidate your submission and you will be completely banned from Ola bug bounty program.

Not accepted

  • Clickjacking
  • Bugs requiring exceedingly unlikely user interaction (e.g Social engineering)
  • Spamming (e.g. SMS/Email Bombing)
  • Any kind of spoofing attacks or any attacks that leads to phishing (e.g. Email spoofing, Capturing login credentials with fake login page)
  • Denial-of-service attacks or vulnerabilities that leads to DOS/DDOS
  • Login - Logout cross-site request forgery
  • Self XSS
  • Presence of server/software banner or version information
  • Stack traces and Error messages which do not reveal any sensitive data
  • Third party API key disclosures without any impact or which are supposed to be open/public.
  • OPTIONS / TRACE HTTP methods enabled
  • Missing HTTP Security Headers (e.g. Strict-Transport-Security - HSTS)
  • Missing Cookie Flags (e.g. HttpOnly, secure etc)
  • Host Header Injection
  • Broken Links (e.g. 404 Not Found page)
  • Known public files or directories disclosure (e.g. robots.txt, css/images etc)
  • Browser ‘autocomplete’ enabled
  • HTML / Text Injection
  • Forced Browsing to non-sensitive information (e.g. help pages)
  • Certificates/TLS/SSL related issues (e.g. BREACH, POODLE)
  • DNS issues (e.g. Missing CName, SPF records etc.)
  • End of Life Browsers / Old Browser versions (e.g. internet explorer 6)
  • Weak CAPTCHA or CAPTCHA bypass (e.g. using browser addons)
  • Coupon Misuse
  • Brute force on forms (e.g. Contact us page)

Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 5 hours ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope

    − Ola Operator mobile app, − Android, − iOS and 6 more

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.