# Alibaba BBP: bug bounty program on HackerOne

> Alibaba BBP is a bug bounty program on HackerOne. It received 0 reports in the 90 days to November 7, 2026, about 0 per in-scope asset.

- **Company:** Alibaba BBP
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/alibaba
- **Pays bounties:** yes
- **Submissions:** paused
- **Launched:** April 15, 2020
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/alibaba

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | not published | 2 |
| High | not published | 7 |
| Medium | not published | 56 |
| Low | not published | 23 |

- Reports received in the last 90 days: 0 (about 0 per in-scope asset)
- Bounties paid in the last 90 days: $0
- Bounties paid in total: $230,625
- Researchers participating: 512
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days
- Barriers: submissions paused

## Scope

As imported from HackerOne on November 6, 2026: 16 assets in scope (16 bounty-eligible), 0 out of scope. The policy page is the authority.

- `*.1688.com` (WILDCARD): in scope, bounty-eligible, max severity medium
- `*.alibaba-inc.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.alibaba.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.alibabacloud.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.aliexpress.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.aliexpress.ru` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.alimama.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.aliyun-inc.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.aliyun.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.cainiao.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.Daraz.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.dingtalk.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.lazada.*` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.taobao.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.tmall.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `www.alibabagroup.com` (URL): in scope, bounty-eligible, max severity critical

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.