GoCardless Bug Bounty Program

At a glance#

• Bounties: Yes
• Swag: No
• Managed by the platform: Yes
• Average first response: 0.3 days
• Average time to resolution: 20.7 days

In scope#

• *.gocardless-cicd.io
• *.gocardless-lab.io
• *.gocardless.dev
• *.gocardless.io,*.gocardless-banking.io
• api-sandbox.gocardless.com
• auth0.gocardless.com
• bankaccountdata.gocardless.com
• connect-sandbox.gocardless.com
• developer.gocardless.com
• http://sso-demo.gocardless-staging.io
• https://ob-sandbox.gocardless.io
• manage-sandbox.gocardless.com
• oauth-sandbox.gocardless.com
• ob.gocardless.com
• pay-sandbox.gocardless.com
• payer-details-sandbox.gocardless.com
• www.gocardless.com

Out of scope#

• *.gocardless-staging.io
• api-staging.gocardless.com
• api.gocardless.com
• brand.gocardless.com
• connect.gocardless.com
• gc4x-api-sandbox.gocardless.com
• gocardless-status.com, status.gocardless.com
• gocardless.atlassian.net
• learn.gocardless.com
• manage.gocardless.com
• oauth-staging.gocardless.com
• oauth.gocardless.com
• outgrow.gocardless.com
• partnerportal.gocardless.com, gocardless.my.site.com
• pay.gocardless.com
• payer-details.gocardless.com
• privacy.gocardless.com
• qbo-api.gocardless.com
• storybook.gocardless.io
• support.gocardless.com
• xero-sandbox.gocardless.com
• xero-staging.gocardless.com
• xero.gocardless.com

Imported from the public directory. Always confirm scope on the official program page before testing.