- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 168
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
| High |
|
$2,500 |
| Medium |
|
$750 |
| Low |
|
$250 |
- Response
-
Within 2 days
Visa will make a best effort to respond to incoming reports within 2 business days and make a bounty determination after validating a legitimate security issue within 15 business days.
- Safe harbor
-
Full
Testing activities conducted in accordance with this Program are protected by a Safe Harbor, meaning that we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
168 assets you may test, 3 excluded.
Web 166
- admin-portal.api-xperience.com Critical
- africa.visa.com Critical
- askpeopleteam.visa.com Critical
- bd.visa.com Critical
- by.visa.com Critical
- capability.prod.innovexperiments.com Critical
- cis.visa.com Critical
- codeofconduct.visa.com Medium
- console.tink.com Critical
- developer.authorize.net Critical
- developer.currencycloud.com High
- developer.cybersource.com Critical
- developer.plus.authorize.net Critical
- developers.pismo.io Medium
- developer.visa.com Critical
- direct-demo.currencycloud.com Critical
- dwy.visa.com Critical
- ebctest.cybersource.com Critical
- forms.cybersource.com Medium
- http://myvisainfinite.com/suntrust/en_us/home.html Critical
- https://ebc2test.cybersource.com/settings Critical
- https://ebctest.cybersource.com/bin Critical
- https://ebctest.cybersource.com/boarding/v1/registrations Critical
- https://ebctest.cybersource.com/boarding/v1/templates Critical
- https://ebctest.cybersource.com/bos Critical
- https://ebctest.cybersource.com/casemanagement Critical
- https://ebctest.cybersource.com/cds Critical
- https://ebctest.cybersource.com/CGK2 Critical
- https://ebctest.cybersource.com/dmconfigapi Critical
- https://ebctest.cybersource.com/epcapi Critical
- https://ebctest.cybersource.com/identity Critical
- https://ebctest.cybersource.com/invoicing Critical
- https://ebctest.cybersource.com/jobs Critical
- https://ebctest.cybersource.com/kms Critical
- https://ebctest.cybersource.com/listmanager Critical
- https://ebctest.cybersource.com/merchant-mgmt Critical
- https://ebctest.cybersource.com/merchantvelocity Critical
- https://ebctest.cybersource.com/mms Critical
- https://ebctest.cybersource.com/notification-subscriptions Critical
- https://ebctest.cybersource.com/oms Critical
- https://ebctest.cybersource.com/partner Critical
- https://ebctest.cybersource.com/payerauthentication Critical
- https://ebctest.cybersource.com/payment Critical
- https://ebctest.cybersource.com/pbl Critical
- https://ebctest.cybersource.com/prcs Critical
- https://ebctest.cybersource.com/prefs Critical
- https://ebctest.cybersource.com/processorconfigapi Critical
- https://ebctest.cybersource.com/products/virtual-terminal Critical
- https://ebctest.cybersource.com/pts/v1/transaction-batch-upload Critical
- https://ebctest.cybersource.com/pts/v2 Critical
- https://ebctest.cybersource.com/reporting Critical
- https://ebctest.cybersource.com/riskui Critical
- https://ebctest.cybersource.com/saconfig Critical
- https://ebctest.cybersource.com/sms Critical
- https://ebctest.cybersource.com/tech-partner-integration Critical
- https://ebctest.cybersource.com/tms Critical
- https://ebctest.cybersource.com/tss Critical
- https://ebctest.cybersource.com/ums Critical
- https://ebctest.cybersource.com/underwriting Critical
- https://ebctest.cybersource.com/varm Critical
- https://ebctest.cybersource.com/vdm Critical
- https://ebctest.cybersource.com/vroom Critical
- https://ebctest.cybersource.com/vts Critical
- https://usa.visa.com/gateway/api Critical
- https://www.currencycloud.com Critical
- https://www.myvisacardportal.com/enbd/en_ae/landing Critical
- https://www.visa.com.az/az_az/account/registration Critical
- https://www.visa.com.ua Critical
- http://test.payworks.io/uis/mngr Critical
- myanmar.visa.com Critical
- my.visa.fr Critical
- myvu.visauniversity.com Medium
- releasor.payworks.com Critical
- rs.visa.com Critical
- sandbox.authorize.net Critical
- sandbox.developer.plus.authorize.net Critical
- sandbox.secure.checkout.visa.com Critical
- sap.api-xperience.com Critical
- survey.visa.com Critical
- testbank.xs2a.com Critical
- test.payworks.io Critical
- usa.visa.com Critical
- vasdemos.visa.com Critical
- vgov.catalogue.digitalcontrolroom.com Medium
- visa.com.au Critical
- visa.com.jm Critical
- visa.com.mx Critical
- visa.com.ru Critical
- visa.co.za Critical
- visainnovationprogram.com Medium
- visaonchainanalytics.com Medium
- visasgic.api-xperience.com Critical
- vwcm.visa.com Critical
- www.authorize.net Critical
- www.cybersource.com Critical
- www.practicalbusinessskills.org Critical
- www.practicalmoneyskills.com Critical
- www.practicalmoneyskills.org Critical
- www.tink.com Critical
- www.trialpay.com Critical
- www.visa.be Critical
- www.visabg.com Critical
- www.visa.ca Critical
- www.visa.cl Critical
- www.visa.cn Critical
- www.visa.co.cr Critical
- www.visa.co.id Critical
- www.visa.co.il Critical
- www.visa.co.in Critical
- www.visa.co.jp Critical
- www.visa.co.ke Critical
- www.visa.com Critical
- www.visa.com.az Critical
- www.visa.com.bo Critical
- www.visa.com.br Critical
- www.visa.com.cy Critical
- www.visa.com.ge Critical
- www.visa.com.hk Critical
- www.visa.com.hn Critical
- www.visa.com.hr Critical
- www.visa.com.jm Critical
- www.visa.com.kh Critical
- www.visa.com.kz Critical
- www.visa.com.lk Critical
- www.visa.com.mx Critical
- www.visa.com.my Critical
- www.visa.com.ng Critical
- www.visa.com.ph Critical
- www.visa.com.ru Critical
- www.visa.com.sg Critical
- www.visa.com.tr Critical
- www.visa.com.tw Critical
- www.visa.com.vn Critical
- www.visa.co.ni Critical
- www.visa.co.nz Critical
- www.visa.co.th Critical
- www.visa.co.uk Critical
- www.visa.co.ve Critical
- www.visa.cz Critical
- www.visa.de Critical
- www.visa.dk Critical
- www.visa.ee Critical
- www.visa.es Critical
- www.visaeurope.at Critical
- www.visaeurope.ch Critical
- www.visaeurope.lu Critical
- www.visaeurope.si Critical
- www.visa.fi Critical
- www.visa.fr Medium
- www.visa.gr Critical
- www.visa.hu Critical
- www.visa.ie Critical
- www.visa.is Critical
- www.visaitalia.com Critical
- www.visakorea.com Critical
- www.visa.lt Critical
- www.visa.lv Critical
- www.visa.mn Critical
- www.visa.nl Critical
- www.visa.no Critical
- www.visa.pl Critical
- www.visa.pt Critical
- www.visa.ro Critical
- www.visa.se Critical
- www.visa.sk Critical
- www.visasoutheasteurope.com Critical
Wildcard domains 2
- *.prod.innovexperiments.com Critical
- *.visamiddleeast.com Critical
Out of scope (3)
- app.demand.cybersource.com
- images.demand.cybersource.com
- info.authorize.net
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Visa (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Keep your discovery and any proposed vulnerabilities strictly confidential. No public disclosure is allowed in our bug bounty program.
-
Not conduct social engineering attacks (e.g. phishing, vishing, smishing) against Visa employees, partners, or customers.
-
Not test the physical security of Visa offices.
-
Only interact with accounts you own. Use test accounts where possible.
-
Not perform any testing that could harm our services such as denial of service (DoS) attacks or destructive injection attacks. Do not spam or brute force any registration or contact functionality.
-
You must check in via your unique URL daily prior to testing Visa assets.
-
Use prefix “visa_bb” + your HackerOne username
-
Use your @wearehackerone.com email address
-
Do not spam application forms and rate limit any automated or manual testing to 1 request per second or longer.
-
please include a custom HTTP header with your HackereOne username in all your traffic: X-Hackerone:
Not accepted
-
Clickjacking on pages with no sensitive actions.
-
Unauthenticated/logout/login CSRF.
-
Attacks requiring MITM or physical access to a user's device.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Missing best practices in SSL/TLS configuration.
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Banner grabbing and fingerprinting (figuring out what web server or technology is in use, etc.).
-
Findings on SaaS applications where is no clear impact or risk to Visa.
-
Any activity that could lead to system disruption or Denial of Service (DoS).
-
Rate limiting or bruteforce issues on non-authentication endpoints.
-
Missing best practices in Content Security Policy.
-
Missing HttpOnly or Secure flags on cookies.
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
-
Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
-
Descriptive error messages or headers
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 4 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
http://test.payworks.io/uis/mngr/
-
Scope added
https://ebc2test.cybersource.com/settings
-
Scope added
https://ebctest.cybersource.com/varm
-
Scope removed
https://solutions.visaacceptance.com/subscription
-
Scope removed
merchantsignage.visa.com (out of scope)
-
Scope removed
merchantsignageca.visa.com (out of scope)
-
Scope removed
merchantsignageeu.visa.com (out of scope)
-
Scope removed
merchantsignageglobal.visa.com (out of scope)
-
Scope removed
info.cybersource.com
-
Scope added
sandbox.developer.plus.authorize.net
-
Scope added
developer.plus.authorize.net
-
Scope removed
api.prod.innovexperiments.com
-
Scope removed
experience.prod.innovexperiments.com
-
Scope removed
www.cardinalcommerce.com
-
Scope removed
infinite.visa.fr
-
Scope removed
vdam.visa.com
-
Scope removed
www.visa.dm
-
Scope removed
garp.visa.com
-
Scope removed
bq.visa.com
-
Scope removed
bb.visa.com
-
Scope removed
bm.visa.com
-
Scope removed
visa.in
-
Scope removed
cw.visa.com
-
Scope removed
ht.visa.com
-
Scope removed
aw.visa.com
-
Scope removed
sr.visa.com
-
Scope removed
www.visa.com.lc
-
Scope removed
www.visa.com.ms
-
Scope removed
www.visa.co.ao
-
Scope removed
www.mz.visa.com
-
Scope removed
www.fraedom.com
-
Scope removed
www.visaeurope.es
-
Scope removed
www.visainfinite.ca
-
Scope removed
www.visa.com.cn
-
Scope removed
www.yellowpepper.com
-
Scope removed
www.visamiddleeast.com
-
Scope removed
merchantsignagejp.visa.com
-
Scope removed
merchantsignageap.visa.com
-
Scope removed
kino.visa.pl
-
Scope removed
cybersourcebouncebacks.visa.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Visa Bug Bounty Program Rules
Visa is a global payments technology company that connects consumers, businesses, financial institutions and governments in more than 200 countries and territories to fast, secure and reliable digital currency.
We have established this Bug Bounty Program to facilitate our exchange of information about potential vulnerabilities, establish rules for vulnerability testing, and provide a safe harbor for individuals who follow these rules.
We look forward to working with the security community to find security vulnerabilities in order to keep our businesses and customers safe. Visa will make a best effort to respond to incoming reports within 2 business days and make a bounty determination after validating a legitimate security issue within 15 business days. We’ll try to keep you informed about our progress throughout the process.
Eligibility
To be eligible to receive rewards, you must:
- Be at least the age of majority in the country where you reside.
- Not be a current Visa employee or a relative of a current Visa employee, and you and/or your relatives cannot have worked at Visa within the past 6 months.
- Be acting in your individual capacity and not on behalf of another company with whom you are employed or have otherwise been retained.
- Not be a resident of a jurisdiction against which the United States has issued comprehensive sanctions or other trade restrictions (e.g., Iran, North Korea, Syria, Cuba, and the Crimea Donetsk, and Luhansk regions of Ukraine,) or a person against whom the United States has issued blocking sanctions (e.g., a Specially Designated National or Blocked Person).
- Conduct all testing and research in accordance with applicable law.
You must also follow the HackerOne rules at all times and have cleared HackerOne’s sanctions screenings and other applicable procedures. Determinations as to whether a submission is eligible for a bounty and otherwise consistent with these rules are within Visa’s sole discretion. If you have discovered a vulnerability on an asset that is not listed in scope as part of Visa’s incentivized bug bounty program and it is a Visa owned asset, please submit it to Visa’s Vulnerability Disclosure program here:
Program Terms
By accepting the invitation and participating in Visa's bug bounty program, you agree with the following terms:
-
If you believe you have discovered a potential security issue or other vulnerability, you must let us know as soon as possible and we’ll make every effort to quickly resolve the issue.
-
Keep your discovery and any proposed vulnerabilities strictly confidential. No public disclosure is allowed in our bug bounty program.
-
Submit only original vulnerability reports identified by you as a HackerOne user and do not copy or otherwise reproduce works to which others may have a claim.
-
A valid vulnerability report must include: (1) the specific affected URL or endpoint, (2) the HTTP request and response demonstrating the issue, (3) step-by-step reproduction, (4) observed behavior and the security impact, and (5) evidence of successful exploitation such as a screenshot or HTTP response body. Reports missing these elements will be returned to the reporter for completion.
-
When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
-
Some in-scope assets share the same code base, the security controls or configurations. Multiple vulnerabilities caused by the same underlying issue will be awarded one bounty for the first report only, regardless of the number of affected domains, URLs or endpoints submitted.
-
Submit one vulnerability per report, unless chaining is required to demonstrate impact. Where vulnerabilities are chained, the full chain must be submitted as a single report. Once a vulnerability has been reported to the program in any form, it is considered disclosed and cannot anchor or contribute to a new bounty claim.
-
If you discover that a previously resolved vulnerability can be bypassed or has been re-introduced through incomplete remediation, submit a new report. Validated bypasses are eligible for the differential award up to 50% based on the severity of the original report. The differential reflects the novelty of the bypass technique, the impact demonstrated, and the scope of affected endpoints.
-
If a vulnerability provides unintended access to data: cease testing and submit a report immediately (e.g., if you encounter any user data during testing, such as Personal Information, credit card data, or proprietary information) – you are not authorized to access any Visa data
-
Not initiate any unauthorized financial transactions
-
Not violate any national, state, or local laws or regulations, and in particular will not violate any data privacy or security laws or regulations
-
Not upload proof of concept artifacts (screenshots, videos, exploits, etc) on third party hosting/cloud providers. Upload these artifacts directly to HackerOne portal.
-
Not conduct social engineering attacks (e.g. phishing, vishing, smishing) against Visa employees, partners, or customers.
-
Not test the physical security of Visa offices.
-
Only interact with accounts you own. Use test accounts where possible.
-
Notify HackerOne or Visa immediately if you become ineligible for the program.
-
Make a good faith effort to avoid modification or destruction of data, and interruption or degradation of our service, and will notify Visa or HackerOne immediately if you believe you inadvertently cause any of these issues.
-
Not perform any testing that could harm our services such as denial of service (DoS) attacks or destructive injection attacks. Do not spam or brute force any registration or contact functionality.
Checking In (Required)
Researcher activity can set off alarms or trigger an incident response process at Visa. We've implemented a mandatory check-in process to identify which IP addresses are being used to test our assets. Not following check-in process may result in bounty ineligibility, even if the report is accepted and fixed. Checking in may prevent human-directed IP blocks by our SOC team, however all traffic is subject to layers of defensive architecture which may automatically block anything that appears to be attack traffic.
Before you begin testing, add your HackereOne username after researcher= to the URL below and visit it from all IPs being used (i.e. if using a VPS or VPN):
You must check in via your unique URL daily prior to testing Visa assets. Feel free to bookmark the URL or integrate it into your scripts.
Creating Testing Accounts
Using or accessing accounts that belong to other users is absolutely prohibited. For testing applications that require authentication, you may only test using accounts you self-register. If self-registration is not possible, you may only conduct unauthenticated testing.
When creating test accounts, you must follow these conventions:
-
Use prefix “visa_bb” + your HackerOne username
-
Use your @wearehackerone.com email address
Automated Scanning and AI-assisted testing
We don’t need help running automated vulnerability scanners. We’ve got those covered. We need your brainpower, not your processing power.
Vulnerabilities reported by automated tools without additional analysis won't be accepted. This includes reports produced or assisted by AI agents and large language model (LLM) tools. Submitting unvalidated AI-generated output as a report is not permitted. All reports must reflect manual confirmation that vulnerability is reproducible. Reports that show signs of unvalidated AI output will be closed as Not Applicable. Repeated low-quality submissions may result in removal from the program.
All testing activity, whether conducted manually or with AI-assisted or automated tools, must be actively supervised by the registered researcher. Fully autonomous testing agents operating without real-time human oversight are prohibited. The researcher whose HackerOne account submitted the report is accountable for all activity generated by their testing infrastructure, including AI-generated traffic.
Furthermore, please be respectful of our applications. Do not spam application forms and rate limit any automated or manual testing to 1 request per second or longer. Failure to do so may be considered a DoS attack and will result in disqualification from the program.
To help us identify test traffic, please include a custom HTTP header with your HackereOne username in all your traffic: X-Hackerone: . Even so, all traffic is subject to layers of defensive architecture which may automatically block anything that appears to be attack traffic.
Scope
Only assets listed in the Scopes table as "In Scope" are valid targets for this program. Do not test assets listed as "Out of Scope". Vulnerability reports for assets not listed in the Scope table are not eligible for bounty, even if they are accepted to be fixed. Reports involving exposed secrets, or sensitive Visa data found in publicly accessible locations — such as public code repositories — may be considered for a discretionary award at Visa's sole determination.
Wildcard entries
Wildcard entries (e.g *.visa.com) in the scope table cover publicly accessible production subdomains only. Testing, development, staging, and non-production environments discovered under a wildcard are out of scope regardless of how the subdomain is named. Indicators of a non-production environment include but are not limited to subdomain prefixes such as test., dev., stage., staging., uat., qa., sandbox., preview. Vulnerabilities found on non-production subdomains are not eligible for bounty unless the researcher demonstrates the issue is reproducible on a production asset explicitly listed in the scope table.
Out of scope vulnerabilities
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
-
Clickjacking on pages with no sensitive actions.
-
Unauthenticated/logout/login CSRF.
-
Attacks requiring MITM or physical access to a user's device.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Missing best practices in SSL/TLS configuration.
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Banner grabbing and fingerprinting (figuring out what web server or technology is in use, etc.).
-
Any finding related to frameable content will be considered only on its merit based on a working proof-of-concept (PoC).
-
Findings on SaaS applications where is no clear impact or risk to Visa.
-
There are some services where the ability to query for a username or email is a product feature. User enumeration will only be rewarded or fixed in cases where it is a deemed a security vulnerability as opposed to a feature.
-
Any activity that could lead to system disruption or Denial of Service (DoS).
-
Rate limiting or bruteforce issues on non-authentication endpoints.
-
Missing best practices in Content Security Policy.
-
Missing HttpOnly or Secure flags on cookies.
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
-
Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
-
Descriptive error messages or headers
-
Zero-days and known N-day vulnerabilities (where N<31) that are found in third-party software, including libraries, frameworks, network devices, COTS and CMS platforms, are not eligible for a bounty even if they contain a valid PoC.
Retest Policy
Retest Invitation: Once a fix has been deployed, Visa may invite the researcher to retest and confirm that the issue is fully fixed. Retest SLA: To maintain our remediation SLAs, researchers are required to complete the retest within 48 hours. If you cannot complete the retest with the SLA, please decline the request. Retests submitted after the 48 hour window will be considered void and ineligible for retest reward.
Retest Award: Researchers who confirm the fix is complete and effective will be awarded based on the severity as triaged and documented by Visa at time of resolution:
-
$400 for Critical
-
$250 for High
-
$100 for Medium
-
$50 for Low
General Terms
Relationship of the Parties
Nothing in these Terms will be construed as creating a joint venture, partnership, employment or agency relationship between you and Visa, and you do not have any authority to create any obligation or make any representation on Visa's behalf.
Proprietary Rights
All ownership rights in the Visa branded-sites listed as in Scope for this program are retained by Visa, its Affiliates and their licensors, and protected under applicable copyrights, trademarks and other proprietary (including intellectual property) rights and international treaties. All rights not expressly granted to you through these Terms are retained by Visa, its Affiliates and their licensors. Nothing in these Terms grants to you any right to use any of Visa's, its Affiliates' or any other third party's trademarks, service marks, logos or other indicia of origin. An “Affiliate” is an entity that is controlled by, controls or is under common control with Visa. Visa grants no rights to an intellectual property on any of the sites listed below and you are not permitted to create derivative works of any such websites.
Finder Representations
You acknowledge that Visa is reliant on the representations you made to HackerOne and that all representations made to HackerOne are true and accurate.
Safe harbor
Testing activities conducted in accordance with this Program are protected by a Safe Harbor, meaning that we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted in accordance with our Rules, we will take steps to make it known that your actions were conducted in compliance with Visa’s Bug Bounty Program.
In operating this Program, Visa does not waive any rights that it may have by not exercising (or delaying the exercise of) such rights. Additionally, should you violate the Rules, Visa retains all rights and other remedies available to it at law or in equity, including the rights to seek injunctive, specific performance or other equitable relief.
Changes to the Rules
Visa may change these Rules or cancel the Bug Bounty program at any time without prior notice. Any changes to the program or these Rules will be posted on Visa’s HackerOne site. If you continue to participate in the program after any such changes are posted, you must follow the Rules as modified.
Thank you for helping keep Visa and our users safe!