Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Wolt

Bug bounty on HackerOne wolt.com

Accepting reports
Go to program Website
Top reward
$3,500
Top severity paid
Critical
Assets in scope
12
Public CVEs
1
Last change

At a glance

What to know before you start testing.

Pays up to $3,500
for critical bugs.
Report on HackerOne
Submit through the program page.
Publish after a fix
Coordinate the timing with the company.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $3,500
High $1,500
Medium $750
Low $150
Hall of fame
Yes # Legacy Hall of Fame We appreciate reports received by the following researchers previously on the Intigriti platform:

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

12 assets you may test, 12 excluded.

Web 7

  • authentication.wolt.com Critical
  • corporate.wolt.com Critical
  • drive.wolt.com Critical
  • merchant.wolt.com Critical
  • ops.wolt.com Critical
  • restaurant-api.wolt.com Critical
  • wolt.com Critical

Android apps 2

  • com.wolt.android Critical
  • com.wolt.courierapp Critical

iOS apps 2

  • 1477299281 Critical
  • 943905271 Critical

Wildcard domains 1

  • *.wolt.com Critical
Out of scope (12)
  • blog.wolt.com
  • gettest.wolt.com
  • https://merchant-onboarding-service.wolt.com/merchant-admin/inbound-merchant
  • https://merchant.wolt.com/api/merchant-onboarding/merchant-admin/inbound-merchant
  • https://merchant.wolt.com/app/partner-with-wolt
  • https://restaurant-api.wolt.com/v1/waw-api/corporate-leads
  • https://wolt.com/en/wolt-for-work-contact-request
  • https://wolt.typeform.com
  • links.wolt.com
  • press.wolt.com
  • wolt.atlassian.net
  • *.pipedrive.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Wolt (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Please provide detailed reports with reproducible steps.
  • Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
  • Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
  • Don't use or interact with accounts or data you don't own, including but not limited to restaurants/venues and merchant data.
  • Use only your own accounts and data for testing purposes.
  • Add the following headers to requests: `X-HackerOne-Research: [H1 username]`.

Not accepted

  • Multiple leaked human identity credentials originating from third-party datasets
  • Spam, social engineering and physical intrusion
  • Network DoS/DDoS attacks
  • Web Cache Poisoned Denial of Service
  • Brute force attacks
  • Attacks requiring access to a victim's computer/device
  • Reports that state that software is out of date/vulnerable without a proof-of-concept
  • Mass creating of entities, including accounts, profiles and applications
  • API key disclosure without proven business impact
  • Signup with unverified mobile numbers
  • Verbose messages/files/directory listings without disclosing any sensitive information
  • CORS misconfiguration without proven impact
  • Missing cookie flags
  • Missing security headers
  • Cross-site Request Forgery without proven impact
  • Autocomplete on web forms
  • Bypassing rate-limits or the non-existence of rate-limits
  • Best practices violations (password complexity, expiration, re-use, etc.)
  • Clickjacking without proven impact/unrealistic user interaction
  • CSV Injection
  • Sessions not being invalidated (logout, enabling 2FA, etc.)
  • Content injection without being able to modify the HTML
  • Username/email enumeration
  • Email bombing
  • HTTP Request smuggling without any proven impact

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 17 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    https://merchant.wolt.com/app/partner-with-wolt (out of scope)

  2. Scope added

    https://wolt.typeform.com (out of scope)

  3. Scope added

    https://wolt.com/en/wolt-for-work-contact-request (out of scope)

  4. Scope added

    https://merchant-onboarding-service.wolt.com/merchant-admin/inbound-merchant (out of scope)

  5. Scope added

    https://restaurant-api.wolt.com/v1/waw-api/corporate-leads (out of scope)

  6. Scope added

    *.pipedrive.com (out of scope)

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2023-22429 High 7.8 11 Apr 2023

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Disclosure Policy

Program Rules

Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

  • Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
  • Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
  • Employees and contractors of the organization are not eligible to participate in this program.
  • ⛔ Don't use or interact with accounts or data you don't own, including but not limited to restaurants/venues and merchant data.
  • ⛔ Use only your own accounts and data for testing purposes.

Testing Plan

  • Users are able to sign up for a free account through our website
  • Please use your hacker email alias when testing ([email protected])
  • Claim credentials (when applicable) for additional testing
  • Add the following headers to requests: X-HackerOne-Research: [H1 username]. Reports resulting in testing without headers can result in the forfeiture of the eligible bounty.
  • Please, keep report brief and concise. 300-400 words per report is a good limit.

Test entities

  • If you need to test any sort of access to user data, please do it only against this specific consumer test account, whose user_id is 670fa3e9ead6e49d65cc3614.
  • If you need to test any sort of access to restaurant or venue data, please do it only against this specific venue test account, whose venue_id is 670e7897e3c56dcc5b5a0989.
  • If you need to test any sort of venue-related functionality, please do it only against this test venue (real purchase is not available): https://wolt.com/en/fin/helsinki/venue/test-670e7897e3c56dcc5b5a0989-sh0p

Where can we get credentials?

We have several user types:

  • Customer account. You can self-register using wolt.com, the iOS app, or the Android app.
  • Courier account. Not available at the moment.
  • Merchants or business account. Not available at the moment.

Out of scope

  • Multiple leaked human identity credentials originating from third-party datasets (leaked credential lists, databases, monitoring services and credential marketplaces)
  • Testing the payment processors is out of scope
  • Spam, social engineering and physical intrusion
  • There are humans behind every Customer Support chat. Any interaction with Customer Support staff, including social engineering attempts, is forbidden and out of scope
  • Network DoS/DDoS attacks
  • Web Cache Poisoned Denial of Service
  • Brute force attacks
  • Attacks requiring access to a victim's computer/device
  • Reports that state that software is out of date/vulnerable without a proof-of-concept
  • Mass creating of entities, including accounts, profiles and applications
  • GATEKEEPER_API_KEY exposure since it is not a secret value

Web

  • API key disclosure without proven business impact
  • Signup with unverified mobile numbers (if you took over an existing number, then that's a finding!)
  • Verbose messages/files/directory listings without disclosing any sensitive information
  • CORS misconfiguration without proven impact
  • Missing cookie flags
  • Missing security headers
  • Cross-site Request Forgery without proven impact
  • Autocomplete on web forms
  • Bypassing rate-limits or the non-existence of rate-limits
  • Best practices violations (password complexity, expiration, re-use, etc.)
  • Clickjacking without proven impact/unrealistic user interaction
  • CSV Injection
  • Sessions not being invalidated (logout, enabling 2FA, etc.)
  • Content injection without being able to modify the HTML
  • Username/email enumeration
  • Email bombing
  • HTTP Request smuggling without any proven impact
  • Homograph attacks
  • Banner grabbing/Version disclosure
  • Subdomain takeover without proof
  • Arbitrary file upload without proof
  • Host header injection without proven business impact

Mobile

  • Shared links leaked through the system clipboard
  • Attacks requiring malicious apps to be installed beforehand
  • Sensitive data in URLs/request bodies when protected by TLS
  • Lack of obfuscation
  • Path disclosure in the binary
  • Lack of jailbreak & root detection
  • Crashes due to malformed URL Schemes
  • Lack of binary protection (anti-debugging) controls, mobile SSL pinning
  • Snapshot/Pasteboard leakage
  • Runtime hacking exploits (exploits only possible in a jailbroken environment)

Legacy Hall of Fame

We appreciate reports received by the following researchers previously on the Intigriti platform: 0xcm1k3, 0xd0m7, 0xdln, _lauritz_, agnel123, altcool6, amirsec76, anhdva, anonymoushobbit, apogiatzis, athulms, badmusmuritado, baloocky, black_dd, bughuntar, bunny0417, callmedaddy, chrismas_here, commadno6407, crofr, cybersamurai, d0xing, deneuv, dk4trin, drak3hft7, drdoctor0, dynnyd20, floerer, giongfnef26, godiego, goseck, greenfire, greensec, gug_saas, h4rshbothra, harshtalavaniya99, hashem_mm, hetroublemak3r, ja, juniorbrets, k_link_1337, kir_tis, kurt4j, liikala96, ling0, lucsouza, m0chan, maara, makaveli, mariosk, marius_dp, mherano, mikemyers, mysc0x1, nc5, nd_passenger, neolokir, ninjan11, noman181, notroks, notron, nva, oxidor, phiko, pod_krinko1, pprab, pushpak35, pwnedchicken, qwe_aldo1, rahimian, redyetidev, richlee, rjflsec, s3c_krd, s3nn, saintbarber, sanfindings, sezo, sheikhrishad, six2dez, slashx0x, soloboy, steffe, talha, testt0, th3ho4ds, thaivd98, the14st, themastersunil, theokeen, thezodd, valbrux, vkiee, wcraft, whitehatind, xburns, yotamsofer, youngvanda, yuzadef, zere, bricked, rev1th

Thank you for helping keep Wolt and our users safe!