Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

PRISM

Vulnerability disclosure program on HackerOne prismlife.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
31
Public CVEs
0
Last change
No changes yet

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Scope

31 assets you may test.

Wildcard domains 17

  • *.belvilla.com Critical No bounty
  • *.checkin.life High No bounty
  • *.dancenter.dk Critical No bounty
  • *.g6hospitality.com Critical No bounty
  • *.innov8.work Low No bounty
  • *.leisure-partners.net High No bounty
  • *.madecomfy.com.au High No bounty
  • *.motel6.com Critical No bounty
  • *.oyocircle.com Medium No bounty
  • *.oyoos.com Critical No bounty
  • *.oyorooms.com Critical No bounty
  • *.oyorooms.io Critical No bounty
  • *.oyotownhouse.com Low No bounty
  • *.oyoworkspaces.com Low No bounty
  • *.traum-ferienwohnungen.de High No bounty
  • *.weddingz.in Medium No bounty
  • *.workflobyoyo.com Low No bounty

Android apps 8

  • com.oyo.consumer No bounty
  • com.oyo.consumerlite No bounty
  • com.oyo.partnerapp No bounty
  • com.oyo.property No bounty
  • Co-OYO Android App - com.oyo.partnerapp High No bounty
  • OYO Android App - com.oyo.consumer Critical No bounty
  • OYO Lite Android app - com.oyo.consumerlite Medium No bounty
  • OYO OS Android App - com.oyo.property High No bounty

iOS apps 4

  • Co-OYO iOS Application High No bounty
  • https://apps.apple.com/in/app/oyo-workspaces/id1448023664 Low No bounty
  • OYO iOS Application Critical No bounty
  • Weddingz iOS App Low No bounty

Web 2

  • patron.oyorooms.com High No bounty
  • prismlife.com Critical No bounty

Rules

What the policy asks of you, and the bug types it won't reward, quoted from PRISM (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • If account registration is required, please use your @wearehackerone.com email alias whenever possible.
  • Only test against assets explicitly listed as in scope.
  • If you identify a vulnerability that provides access to sensitive data, internal systems, or privileged functionality, do not proceed beyond what is necessary to demonstrate impact.
  • Avoid actions that may negatively affect the availability, integrity, or performance of our systems.
  • If using automated scanning tools, include your HackerOne username in requests whenever feasible using a custom header: X-HackerOne: your_username
  • Keep all findings and communications confidential.
  • Not disclose vulnerabilities to any third party without prior written authorization.
  • Not access, modify, destroy, or exfiltrate data that does not belong to you.
  • Not disrupt, degrade, or impair PRISM services or business operations.
  • Not conduct social engineering, phishing, spam, physical security testing, DoS, or DDoS attacks.

Not accepted

  • CAPTCHA-related issues
  • Missing rate-limiting or account lockout mechanisms
  • Open redirects without demonstrated security impact
  • Self-XSS
  • Host Header Injection without demonstrated impact
  • Clickjacking without demonstrated impact
  • Missing HTTP security headers
  • Missing cookie attributes
  • Banner or version disclosure
  • SPF, DKIM, or DMARC findings
  • SSL/TLS best-practice issues
  • OPTIONS / TRACE methods enabled
  • Error messages that do not expose sensitive information
  • Login or Logout CSRF
  • CSV Injection without demonstrated impact
  • Content spoofing or text injection without demonstrated security impact
  • Third-party vulnerabilities that do not affect PRISM-owned assets
  • Vulnerabilities requiring physical access to a device
  • Vulnerabilities requiring outdated browsers or operating systems
  • Vulnerabilities requiring Man-in-the-Middle attacks
  • Social engineering, phishing, spam, DoS, or DDoS attacks
  • Issues that require unlikely or unrealistic user interaction

Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 4 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

#Program Details

We appreciate the efforts of independent security researchers who help us improve the security of our systems. If you believe you have discovered a security vulnerability in an in-scope asset, please submit a report with sufficient detail for our team to reproduce and validate the issue. We are committed to reviewing all legitimate submissions and working with researchers to understand, triage, and remediate confirmed vulnerabilities. Good luck, and happy hunting!

#Severity Assessment PRISM follows HackerOne's severity rating methodology when evaluating reported vulnerabilities. Please note that severity may be adjusted based on factors such as:

  • Exploitability
  • Business impact
  • Data sensitivity
  • Required privileges
  • Environmental controls
  • Real-world risk

The final severity determination rests with the PRISM Security Team.

#Testing Guidelines

  • If account registration is required, please use your @wearehackerone.com email alias whenever possible.
  • Only test against assets explicitly listed as in scope.
  • If you identify a vulnerability that provides access to sensitive data, internal systems, or privileged functionality, do not proceed beyond what is necessary to demonstrate impact.
  • Avoid actions that may negatively affect the availability, integrity, or performance of our systems.
  • If using automated scanning tools, include your HackerOne username in requests whenever feasible using a custom header: X-HackerOne: your_username

#Reporting Guidelines To help us investigate efficiently, please ensure your report contains:

  • Clear description of the issue
  • Affected asset(s)
  • Reproduction steps
  • Proof of Concept (PoC)
  • Relevant screenshots, logs, or evidence
  • Impact assessment

Additional guidelines:

  • Submit one vulnerability per report unless multiple issues must be chained together to demonstrate impact.
  • Multiple vulnerabilities resulting from a single underlying root cause may be treated as one issue.
  • Duplicate reports will generally be closed in favor of the first reproducible submission.
  • Researchers may be requested to assist with validation or remediation verification activities.

#Rules of Engagement By participating in this program, you agree to:

  • Keep all findings and communications confidential.
  • Not disclose vulnerabilities to any third party without prior written authorization.
  • Not access, modify, destroy, or exfiltrate data that does not belong to you.
  • Not disrupt, degrade, or impair PRISM services or business operations.
  • Not conduct social engineering, phishing, spam, physical security testing, DoS, or DDoS attacks.
  • Not intentionally compromise the privacy, security, intellectual property, or commercial interests of PRISM, its brands, employees, partners, or customers.
  • Destroy vulnerability-related artefacts once the report has been resolved and closed.

Failure to comply with these rules may result in report ineligibility and removal from the program.

#Program Exclusions – Out of Scope Vulnerabilities

  • PRISM adheres to HackerOne's Core Ineligible Findings policy.

  • Additionally Out of Scope-

CAPTCHA-related issues Missing rate-limiting or account lockout mechanisms Open redirects without demonstrated security impact Self-XSS Host Header Injection without demonstrated impact Clickjacking without demonstrated impact Missing HTTP security headers Missing cookie attributes Banner or version disclosure SPF, DKIM, or DMARC findings SSL/TLS best-practice issues OPTIONS / TRACE methods enabled Error messages that do not expose sensitive information Login or Logout CSRF CSV Injection without demonstrated impact Content spoofing or text injection without demonstrated security impact Third-party vulnerabilities that do not affect PRISM-owned assets Vulnerabilities requiring physical access to a device Vulnerabilities requiring outdated browsers or operating systems Vulnerabilities requiring Man-in-the-Middle attacks Social engineering, phishing, spam, DoS, or DDoS attacks Issues that require unlikely or unrealistic user interaction

PRISM reserves the right to determine the final validity, impact, and eligibility of all reported vulnerabilities.

#Safe Harbor When conducting vulnerability research in accordance with this policy, we consider such activity to be authorized and conducted in good faith for the purpose of improving the security of our systems and services. PRISM will not pursue legal action against researchers who:

  • Follow this policy
  • Act in good faith
  • Avoid privacy violations, service disruption, and data destruction
  • Promptly report discovered vulnerabilities
  • Comply with applicable laws and regulations

If you are uncertain whether a particular testing activity is permitted under this policy, please contact us through HackerOne before proceeding.

Thank you for helping improve the security of PRISM and its portfolio of brands.