Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

PepsiCo VDP

By PepsiCo Vulnerability disclosure program on HackerOne pepsico.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
227
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Safe harbor
Partial Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

227 assets you may test.

Wildcard domains 85

  • *.alvalle.com Critical No bounty
  • *.aquafina.com Critical No bounty
  • *.baresnacks.com Critical No bounty
  • *.bubly.com Critical No bounty
  • *.capncrunch.com Critical No bounty
  • *.cheetos.com Critical No bounty
  • *.crackerjack.com Critical No bounty
  • *.crackerjill.com Critical No bounty
  • *.craftedforhome.com Critical No bounty
  • *.doritos.com Critical No bounty
  • *.doritos.co.uk Critical No bounty
  • *.dousaflavor.com Critical No bounty
  • *.drinkbrisk.com Critical No bounty
  • *.drinkevolve.com Critical No bounty
  • *.fl-vr.com Critical No bounty
  • *.foundedbyher.org Critical No bounty
  • *.fritolay.com Critical No bounty
  • *.fritolayminis.com Critical No bounty
  • *.fritolayvarietypacks.com Critical No bounty
  • *.fritos.com Critical No bounty
  • *.funyuns.com Critical No bounty
  • *.gamesacookies.com Critical No bounty
  • *.gatorade.com Critical No bounty
  • *.getsoulboost.com Critical No bounty
  • *.grandmascookies.com Critical No bounty
  • *.healthwarrior.com Critical No bounty
  • *.hilolife.com Critical No bounty
  • *.houseofpepsico.com Critical No bounty
  • *.jacklinksfritolay.com Critical No bounty
  • *.joyapp.mx Critical No bounty
  • *.joypepsico.com Critical No bounty
  • *.joy-pepsico.eu Critical No bounty
  • *.lays.com Critical No bounty
  • *.lays.pl Critical No bounty
  • *.lifewtr.com Critical No bounty
  • *.liptonicedtea.com Critical No bounty
  • *.looza.be Critical No bounty
  • *.missvickies.com Critical No bounty
  • *.moresmileswitheverybite.com Critical No bounty
  • *.mountaindew.com Critical No bounty
  • *.munchiessnacks.com Critical No bounty
  • *.musclemilk.com Critical No bounty
  • *.mypepsico.com Critical No bounty
  • *.natuchipsusa.com Critical No bounty
  • *.neareast.com Critical No bounty
  • *.offtheeatenpathsnacks.com Critical No bounty
  • *.pantryshop.com Critical No bounty
  • *.pbsg.com Critical No bounty
  • *.pearlmillingcompany.com Critical No bounty
  • *.pepsicobeveragefacts.com Critical No bounty
  • *.pepsico.com Critical No bounty
  • *.pepsico.co.uk Critical No bounty
  • *.pepsicofoodforgood.com Critical No bounty
  • *.pepsi.com Critical No bounty
  • *.pepsicopartners.com Critical No bounty
  • *.pepsicoproductfacts.com Critical No bounty
  • *.pepsicoschoolsource.com Critical No bounty
  • *.pepsidigin.com Critical No bounty
  • *.pepsimundo.com Critical No bounty
  • *.pepsi.pl Critical No bounty
  • *.pepviz.com Critical No bounty
  • *.popcorners.com Critical No bounty
  • *.propelwater.com Critical No bounty
  • *.pureleaf.com Critical No bounty
  • *.quakeroats.com Critical No bounty
  • *.refreshthenrecycle.com Critical No bounty
  • *.ricearoni.com Critical No bounty
  • *.rockstarenergy.com Critical No bounty
  • *.roldgold.com Critical No bounty
  • *.ruffles.com Critical No bounty
  • *.sabra.com Critical No bounty
  • *.santitas.com Critical No bounty
  • *.simplyfritolay.com Critical No bounty
  • *.smartfood.com Critical No bounty
  • *.snacks.com Critical No bounty
  • *.sobe.com Critical No bounty
  • *.stacyssnacks.com Critical No bounty
  • *.standardysprzetpepsico.pl Critical No bounty
  • *.stubbornsoda.com Critical No bounty
  • *.sunchips.com Critical No bounty
  • *.tastyrewards.ca Critical No bounty
  • *.tastyrewards.com Critical No bounty
  • *.tostitos.com Critical No bounty
  • *.walkers.co.uk Critical No bounty
  • *.yachak.com Critical No bounty

Web 84

  • alvalle.com Critical No bounty
  • aquafina.com Critical No bounty
  • baresnacks.com Critical No bounty
  • bubly.com Critical No bounty
  • capncrunch.com Critical No bounty
  • cheetos.com Critical No bounty
  • crackerjack.com Critical No bounty
  • crackerjill.com Critical No bounty
  • craftedforhome.com Critical No bounty
  • doritos.com Critical No bounty
  • drinkbrisk.com Critical No bounty
  • drinkevolve.com Critical No bounty
  • fl-vr.com Critical No bounty
  • foundedbyher.org Critical No bounty
  • fritolay.com Critical No bounty
  • fritolayminis.com Critical No bounty
  • fritolayvarietypacks.com Critical No bounty
  • fritos.com Critical No bounty
  • funyuns.com Critical No bounty
  • gamesacookies.com Critical No bounty
  • gatorade.com Critical No bounty
  • getsoulboost.com Critical No bounty
  • grandmascookies.com Critical No bounty
  • healthwarrior.com Critical No bounty
  • hilolife.com Critical No bounty
  • investor.pepsico.com Critical No bounty
  • investors.pepsico.com Critical No bounty
  • jacklinksfritolay.com Critical No bounty
  • lays.com Critical No bounty
  • lifewtr.com Critical No bounty
  • liptonicedtea.com Critical No bounty
  • looza.be Critical No bounty
  • missvickies.com Critical No bounty
  • moresmileswitheverybite.com Critical No bounty
  • mountaindew.com Critical No bounty
  • munchiessnacks.com Critical No bounty
  • musclemilk.com Critical No bounty
  • natuchipsusa.com Critical No bounty
  • neareast.com Critical No bounty
  • offtheeatenpathsnacks.com Critical No bounty
  • pantryshop.com Critical No bounty
  • pearlmillingcompany.com Critical No bounty
  • pepsicobeveragefacts.com Critical No bounty
  • pepsicofoodforgood.com Critical No bounty
  • pepsi.com Critical No bounty
  • pepsicopartners.com Critical No bounty
  • pepsicoproductfacts.com Critical No bounty
  • pepsicoschoolsource.com Critical No bounty
  • pepsidigin.com Critical No bounty
  • pepviz.com Critical No bounty
  • popcorners.com Critical No bounty
  • propelwater.com Critical No bounty
  • pureleaf.com Critical No bounty
  • quakeroats.com Critical No bounty
  • refreshthenrecycle.com Critical No bounty
  • ricearoni.com Critical No bounty
  • rockstarenergy.com Critical No bounty
  • roldgold.com Critical No bounty
  • ruffles.com Critical No bounty
  • sabra.com Critical No bounty
  • santitas.com Critical No bounty
  • simplyfritolay.com Critical No bounty
  • smartfood.com Critical No bounty
  • snacks.com Critical No bounty
  • sobe.com Critical No bounty
  • sodastream.com.ar Critical No bounty
  • sodastream.com.br Critical No bounty
  • sodastream.com.tw Critical No bounty
  • sodastream.co.nz Critical No bounty
  • sodastream.co.za Critical No bounty
  • sodastream.cz Critical No bounty
  • sodastream.it Critical No bounty
  • sodastream.jp Critical No bounty
  • sodastream.kr Critical No bounty
  • sodastreammexico.com Critical No bounty
  • sodastream.sg Critical No bounty
  • stacyssnacks.com Critical No bounty
  • stubbornsoda.com Critical No bounty
  • sunchips.com Critical No bounty
  • tastyrewards.com Critical No bounty
  • tostitos.com Critical No bounty
  • tostitos.co.uk Critical No bounty
  • www.pepsico.com Critical No bounty
  • yachak.com Critical No bounty

Networks 51

  • 165.197.100.0/23 Critical No bounty
  • 165.197.108.0/24 Critical No bounty
  • 165.197.109.0/24 Critical No bounty
  • 165.197.110.0/23 Critical No bounty
  • 165.197.112.0/23 Critical No bounty
  • 165.197.180.0/24 Critical No bounty
  • 165.197.182.0/24 Critical No bounty
  • 165.197.183.0/24 Critical No bounty
  • 165.197.216.0/22 Critical No bounty
  • 165.197.220.0/22 Critical No bounty
  • 165.197.64.0/23 Critical No bounty
  • 165.197.66.0/23 Critical No bounty
  • 165.197.67.0/24 Critical No bounty
  • 165.197.72.0/24 Critical No bounty
  • 165.197.74.0/23 Critical No bounty
  • 165.197.96.0/24 Critical No bounty
  • 165.197.97.0/24 Critical No bounty
  • 165.197.98.0/23 Critical No bounty
  • 198.231.16.0/24 Critical No bounty
  • 198.231.17.0/24 Critical No bounty
  • 198.231.20.0/24 Critical No bounty
  • 198.231.21.0/24 Critical No bounty
  • 198.231.22.0/24 Critical No bounty
  • 198.231.23.0/24 Critical No bounty
  • 204.136.100.0/23 Critical No bounty
  • 204.136.102.0/24 Critical No bounty
  • 204.136.103.0/24 Critical No bounty
  • 204.136.104.0/24 Critical No bounty
  • 204.136.105.0/24 Critical No bounty
  • 204.136.106.0/24 Critical No bounty
  • 204.136.107.0/24 Critical No bounty
  • 204.136.112.0/24 Critical No bounty
  • 204.136.113.0/24 Critical No bounty
  • 204.136.114.0/24 Critical No bounty
  • 204.136.115.0/24 Critical No bounty
  • 204.136.116.0/24 Critical No bounty
  • 204.136.117.0/24 Critical No bounty
  • 204.136.118.0/24 Critical No bounty
  • 204.136.64.0/23 Critical No bounty
  • 204.136.66.0/23 Critical No bounty
  • 204.136.68.0/23 Critical No bounty
  • 204.136.70.0/23 Critical No bounty
  • 204.136.72.0/23 Critical No bounty
  • 204.136.74.0/24 Critical No bounty
  • 204.136.75.0/24 Critical No bounty
  • 204.136.76.0/24 Critical No bounty
  • 204.136.77.0/24 Critical No bounty
  • 204.136.78.0/24 Critical No bounty
  • 204.136.79.0/24 Critical No bounty
  • 204.136.96.0/23 Critical No bounty
  • 204.136.98.0/23 Critical No bounty

Android apps 7

  • com.pepsico.agri.gh Critical No bounty
  • com.PepsiCoConsumer.Minegocioec Critical No bounty
  • com.PepsiCoConsumer.Minegociope Critical No bounty
  • com.pepsicoconsumer.pepsicogfn Critical No bounty
  • com.PepsiCoConsumer.Pepsicopartner Critical No bounty
  • com.pepsico.kazandirio Critical No bounty
  • com.pepsicolatam.joy Critical No bounty

Rules

What the policy asks of you, and the bug types it won't reward, quoted from PepsiCo VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Please provide detailed reports with reproducible steps.
  • Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
  • Social engineering (e.g., phishing, vishing, smishing) is prohibited.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Only interact with accounts you own or with explicit permission of the account holder.
  • No testing of Third-party Services.
  • Do not upload vulnerability or client-related content to third-party utilities (e.g. Github, DropBox).
  • Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.

Not accepted

  • Disclosed Google Maps API Keys
  • Account/e-mail enumeration using brute-force attacks.
  • Any low impact issues related to session management (i.e. concurrent sessions, session expiration, password reset/change log out, etc.)
  • Bypassing content restrictions in uploading a file without proving the file was received.
  • Client-side application/browser autocomplete or saved password/credentials.
  • Issues related to password/credential strength, length, lockouts, or lack of brute-force/rate-limiting protections.
  • Lack of SSL or Mixed content.
  • Missing/Enabled HTTP Headers/Methods which do not lead directly to a security vulnerability.
  • Reflected file download attacks (RFD).
  • Use of a known-vulnerable library which leads to a low-impact vulnerability (i.e. jQuery outdated version leads to low impact XSS).
  • IIS Tilde File and Directory Disclosure.
  • SSH Username Enumeration.
  • WordPress Username Enumeration.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 57 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    sodastream.co.nz

  2. Scope added

    sodastream.co.za

  3. Scope added

    sodastream.com.ar

  4. Scope added

    sodastream.com.tw

  5. Scope added

    sodastream.kr

  6. Scope added

    sodastream.sg

  7. Scope added

    sodastream.com.br

  8. Scope added

    sodastream.it

  9. Scope added

    sodastream.cz

  10. Scope added

    sodastreammexico.com

  11. Scope added

    sodastream.jp

  12. Scope added

    *.fritolay.com

  13. Scope added

    *.baresnacks.com

  14. Scope added

    *.bubly.com

  15. Scope added

    *.fl-vr.com

  16. Scope added

    *.drinkevolve.com

  17. Scope added

    *.drinkbrisk.com

  18. Scope added

    *.aquafina.com

  19. Scope added

    *.doritos.com

  20. Scope added

    *.jacklinksfritolay.com

  21. Scope added

    *.doritos.co.uk

  22. Scope added

    *.dousaflavor.com

  23. Scope added

    *.craftedforhome.com

  24. Scope added

    *.crackerjill.com

  25. Scope added

    *.grandmascookies.com

  26. Scope added

    *.foundedbyher.org

  27. Scope added

    *.crackerjack.com

  28. Scope added

    *.fritolayminis.com

  29. Scope added

    *.fritolayvarietypacks.com

  30. Scope added

    *.fritos.com

  31. Scope added

    *.getsoulboost.com

  32. Scope added

    *.gatorade.com

  33. Scope added

    *.gamesacookies.com

  34. Scope added

    *.funyuns.com

  35. Scope added

    *.cheetos.com

  36. Scope added

    *.healthwarrior.com

  37. Scope added

    *.hilolife.com

  38. Scope added

    *.houseofpepsico.com

  39. Scope added

    *.capncrunch.com

  40. Scope added

    *.alvalle.com

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

#Introduction Welcome to the PepsiCo Responsible Disclosure Program! At PepsiCo, we take security seriously. If you believe that you have found an application security vulnerability that affects PepsiCo, please report it to us using the “Submit Report” button on this page.

We’re excited to work with HackerOne and the hacker community to help keep PepsiCo secure.

Disclosure Policy

  • Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
  • Follow HackerOne's disclosure guidelines.

Program Rules

  • Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
  • Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
  • Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
  • Social engineering (e.g., phishing, vishing, smishing) is prohibited.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
  • Only interact with accounts you own or with explicit permission of the account holder.
  • No testing of Third-party Services.
  • Do not upload vulnerability or client-related content to third-party utilities (e.g. Github, DropBox).

Core Ineligible Vulnerabilities

The following issues will be closed as invalid except in rare circumstances demonstrating clear security impact:

  • Core Ineligible findings
  • Disclosed Google Maps API Keys
  • Account/e-mail enumeration using brute-force attacks.
  • Any low impact issues related to session management (i.e. concurrent sessions, session expiration, password reset/change log out, etc.)
  • Bypassing content restrictions in uploading a file without proving the file was received.
  • Client-side application/browser autocomplete or saved password/credentials.
  • Issues related to password/credential strength, length, lockouts, or lack of brute-force/rate-limiting protections.
  • Lack of SSL or Mixed content.
  • Missing/Enabled HTTP Headers/Methods which do not lead directly to a security vulnerability.
  • Reflected file download attacks (RFD).
  • Use of a known-vulnerable library which leads to a low-impact vulnerability (i.e. jQuery outdated version leads to low impact XSS).
  • IIS Tilde File and Directory Disclosure.
  • SSH Username Enumeration.
  • WordPress Username Enumeration.

When reporting potential vulnerabilities, please consider: (1) realistic attack scenarios (2) the security impact of the behavior. If you have reported an issue determined to be within program scope; is determined to be a valid security issue; and further you have followed the program rules, PepsiCo VDP will recognize your finding after a fix has been issued.

Thank you for helping keep Pepsi and our users safe!