Starling Bank VDP
By Starling Bank Limited Vulnerability disclosure program on HackerOne starlingbank.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 2 days
Time to first response (from report submit) - 2 days
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test.
Web 10
- api-openbanking.starlingbank.com Critical No bounty
- api.starlingbank.com Critical No bounty
- app.starlingbank.com Critical No bounty
- developer.starlingbank.com Critical No bounty
- help.starlingbank.com Critical No bounty
- oauth.starlingbank.com Critical No bounty
- openbanking.starlingbank.com Critical No bounty
- payment-api.starlingbank.com Critical No bounty
- token-api.starlingbank.com Critical No bounty
- www.starlingbank.com Medium No bounty
Android apps 1
- com.starlingbank.android Critical No bounty
iOS apps 1
- uk.co.starlingbank.Starling Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Starling Bank VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Do not break the law
-
Do not use social engineering techniques against our customers or staff
-
Do not put any Starling Bank or customer data at risk
-
Do be specific
-
Do provide a detailed and complete submission (masking or encrypting if necessary)
-
Do reference existing vulnerability information where relevant
Not accepted
-
reports of generic vulnerabilities with no evidence of relevance to our systems
-
reports of any information already in the public domain
-
reports that are vague or non-actionable
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 57 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
It’s important that anybody is able to contact us, quickly and effectively, with security concerns or information pertinent to our customers’ privacy or the confidentiality, integrity or availability of our systems. Therefore we operate a responsible disclosure policy to help security professionals and others alert us swiftly with the minimum of fuss.
Response Targets
Starling Bank Limited will make a best effort to meet the following response targets for hackers participating in our program:
- Time to first response (from report submit) - 2 days
- Time to triage (from report submit) - 2 days
We’ll try to keep you informed about our progress throughout the process.
Disclosure Policy
At all times act responsibly and in the best interests of Starling Bank and our customers.
- Do not break the law
- Do not use social engineering techniques against our customers or staff
- Do not put any Starling Bank or customer data at risk
- Do be specific
- Do provide a detailed and complete submission (masking or encrypting if necessary)
- Do reference existing vulnerability information where relevant
- Follow HackerOne's disclosure guidelines.
It is important that we treat your communication as a responsible disclosure and not an attack or extortion.
Program Rules
You agree to the terms of our Privacy Notice and that we can use your submission and its contents to ensure the security, integrity and reliable operation of our technology and business. Your submission should contain:
- Clear description and evidence of the vulnerability (logs, screenshots, responses)
- Detailed steps to reproduce the issue
- Any platforms, operating systems, versions that are relevant
- Any relevant IP addresses or URLs
- Any supporting evidence you have collected (logging, tracing etc.)
- Your assessment of the exploitability or impact of the issue
- Your name, role (if appropriate) and contact details
- Please preserve as much evidence as possible as we may need to examine it.
Our ability to respond quickly and effectively to important communication and in conjunction with hackerone, we take steps to manage spam and quickly identify high quality submissions. We discourage and will not respond to:
- reports of generic vulnerabilities with no evidence of relevance to our systems
- reports of any information already in the public domain
- reports that are vague or non-actionable We will respond quickly and gratefully if we believe that you are faithfully reporting an issue in line with these terms and in the best interests of Starling Bank and its customers.
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Confidentiality
You must treat all information about our systems, staff or customers that comes into your possession or that you otherwise become aware of, which is not publicly available, as strictly confidential and not share or otherwise use it for any purpose other than emailing it to us as a submission as described above.
Thank you for helping keep Starling Bank Limited and our users safe!