Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

XP Inc Vulnerability Disclosure

By XP Inc Vulnerability disclosure program on HackerOne xpi.com.br

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
14
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Partial safe harbor
Some legal protection; read the terms.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Safe harbor
Partial Tests are authorized only on XP digital assets explicitly listed as “in-scope” on the program's official page.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

14 assets you may test.

Web 8

  • clear.com.br Critical No bounty
  • expertxp.com.br Medium No bounty
  • infomoney.com.br High No bounty
  • modalmais.com.br Critical No bounty
  • rico.com.vc Critical No bounty
  • xpeducacao.com.br Critical No bounty
  • xpempresas.com.br Critical No bounty
  • xpi.com.br Critical No bounty

Android apps 3

  • https://play.google.com/store/apps/details?id=br.com.xp.carteira Critical No bounty
  • https://play.google.com/store/apps/details?id=br.com.xpinc.clear.app.android Critical No bounty
  • https://play.google.com/store/apps/details?id=br.com.xpinc.xpempresas Critical No bounty

iOS apps 3

  • https://apps.apple.com/br/app/clear/id6447694643 Critical No bounty
  • https://apps.apple.com/br/app/xp-empresas-conta-pj/id1566254578 Critical No bounty
  • https://apps.apple.com/br/app/xp-investimentos/id1300713021 Critical No bounty

Rules

What the policy asks of you, and the bug types it won't reward, quoted from XP Inc Vulnerability Disclosure (via HackerOne)'s policy.

While testing

  • Don't cause unavailability or degradation of service (no DOS/DDoS, resource exhaustion, or aggressive scanning).
  • Do not carry out brute force attacks or account compromise (login, password recovery, MFA, etc.).
  • Do not initiate or manipulate real financial transactions or transactions that may generate financial impact.
  • Do not access, copy, store, or disclose personal or sensitive data. If you access something like this, interrupt the test, securely delete the data, and report it.
  • Don't use social engineering or physical attacks against XP customers, employees, partners, or facilities.
  • Do not violate any applicable law, regulation, or regulatory authority rule.
  • Do not request a ransom, mandatory reward, or any type of blackmail based on the vulnerability found.
  • Also follow the policies of the platform where the program is hosted (for example, responsible disclosure guidelines).

Not accepted

  • Display of banners, versions, or error messages with no relevant security impact
  • Self-exploration (Self-XSS, Self-DOS, etc.) with no plausible path to attack other users
  • Lack of Headers as a secure cookie and HttpOnly
  • Missing HTTP security headers
  • Missing best practices (content security policies, tabnabbing, SPF/DKIM/DMARC email records), unless a significant impact can be demonstrated.
  • Open redirect, unless a significant impact can be demonstrated.
  • Problems that require unlikely interaction on the part of the victim.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Status

    Program status changed

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Are there any safety warning points you want to report?

Tests are authorized only on XP digital assets explicitly listed as “in-scope” on the program's official page. • Only domains, apps, APIs, and services marked as within scope can be tested. • Any asset not listed is automatically considered out of scope. • If an in-scope target redirects to an unlisted domain, the target domain is out of scope. • You must not publicly disclose vulnerability details, POCs, or XP-related data without express authorization from the company.

Rules of conduct for tests

By participating in the program, you commit to: • Don't cause unavailability or degradation of service (no DOS/DDoS, resource exhaustion, or aggressive scanning). • Do not carry out brute force attacks or account compromise (login, password recovery, MFA, etc.). • Do not initiate or manipulate real financial transactions or transactions that may generate financial impact. • Do not access, copy, store, or disclose personal or sensitive data. If you access something like this, interrupt the test, securely delete the data, and report it. • Don't use social engineering or physical attacks against XP customers, employees, partners, or facilities. • Do not violate any applicable law, regulation, or regulatory authority rule. • Do not request a ransom, mandatory reward, or any type of blackmail based on the vulnerability found. • Also follow the policies of the platform where the program is hosted (for example, responsible disclosure guidelines).

What is out of scope

As a rule, the following are outside the scope of the XP Responsible Disclosure Program: • Physical testing at facilities, offices, or data centers • Social engineering and phishing • Denial of service (DoS, DDoS) attacks and resource exhaustion • Attacks that rely on physical access to devices • Problems that only affect obsolete browsers or operating systems • Display of banners, versions, or error messages with no relevant security impact • Self-exploration (Self-XSS, Self-DOS, etc.) with no plausible path to attack other users • Lack of Headers as a secure cookie and HttpOnly • Missing HTTP security headers • Missing best practices (content security policies, tabnabbing, SPF/DKIM/DMARC email records), unless a significant impact can be demonstrated. • Open redirect, unless a significant impact can be demonstrated. • Problems that require unlikely interaction on the part of the victim.

When submitting a report, include:

• Vulnerability summary: what it is, where it was found and what is the potential impact. • Playback step by step: URLs, parameters, payloads, and necessary context. • Technical evidence: relevant requests/responses, simplified PoC and prints (without sensitive data). • Affected scope and attack scenario: what an attacker could actually do by exploiting the flaw. Submit a vulnerability by report, unless it is necessary to chain together flaws to demonstrate the impact. In case of duplication, we will consider the first report complete and reproducible.

Dissemination and recognition

• You must not publicly disclose vulnerability details, POCs, or XP-related data without express authorization from the company. • XP will analyze the reports with seriousness and risk-based prioritization. • Any rewards or recognitions, when they exist, will be defined and announced on the program's official channel (website or bug bounty/VDP platform) and will follow XP's internal and regulatory policies.

Researchers should add headers to requests such as:

  • “X-HackerOne-Research: [H1 username]”

Thank you for helping keep XP Inc. and our users safe!