Live programT&C required
Acme Fintech — E-commerce Bug Bounty Program
Acme Fintech — Programme Bug Bounty E-commerce
- Reports
- 0
- 1st response
- —
- Assets
- 3
- Updated
- Oct 14, 2026
Rewards
| Severity | Rewards |
|---|---|
| P1Critical | Up to 8,000 $ |
| P2High | Up to 3,000 $ |
| P3Medium | Up to 1,200 $ |
| P4Low | Up to 300 $ |
| P5Informational | — |
Escrow: 2,500 $
In scope
| Scope | Type | Value |
|---|---|---|
| https://www.acme-fintech.cm | Web application | High |
| api.acme-fintech.cm | Web application | High |
| seller.acme-fintech.cm | Web application | High |
Out of scope
- DDoS
- Spam
- Social engineering
Vulnerability types
Qualifying
- SQLi (CWE-89)
- XSS (CWE-79)
- IDOR (CWE-639)
- SSRF (CWE-918)
- RCE
- Auth bypass (CWE-287)
- Privilege escalation
- PII leak
Non-qualifying
- Missing headers alone
- Self-XSS
- Clickjacking without impact
- Known CVE without PoC
- DoS/DDoS
- User enumeration
- SPF/DKIM/DMARC
- Outdated libraries
Safe harbor
Authorized scope only. No payment testing out of scope. 90-day coordinated disclosure.
I agree to test only the authorized scope. No scope = no test.