Chime Managed Bug Bounty Engagement

At a glance#

• Maximum payout: $20,000
• Public disclosure: Not allowed
• Managed by the platform: Yes
• Safe harbour: Full

In scope#

• All Chime Assets
• *.chimepayments.com
• https://*.chime.com
• *.1debit.com
• *.chimecard.com
• *.chmfin.com
• *.chimebank.com
• https://www.chime.com
• https://app.chime.com
• https://play.google.com/store/apps/details?id=com.onedebit.chime
• https://apps.apple.com/us/app/chime-mobile-banking/id836215269
• https://drive.google.com/file/d/17IX06JcI2Nn7hbg9kDps5iK6oVi9U71O/view?usp=sharing
• http://member-qa.chime.com/enroll
• http://app-qa.chime.com/users/sign_in
• *.saltlabs.com
• https://app.saltlabs.com/
• https://play.google.com/store/apps/details?id=com.saltlabs.app
• https://apps.apple.com/us/app/salt-work-and-get-rewarded/id1668462142
• https://app.staging.saltlabs.com/

Out of scope#

• Non Chime Owned Assets (see list above)
• https://chime.financial
• https://chimescholars.org

Imported from the public directory. Always confirm scope on the official program page before testing.