In brief. Amazon Vulnerability Research Program is a bug bounty program on HackerOne. It received 1,887 reports in the 90 days to November 9, 2026, about 8.4 per in-scope asset.
NR
Unrated
Amazon Vulnerability Research Program
3 more reviews needed for a grade
Write a review
Claim this company profile
Work at Amazon Vulnerability Research Program? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.
Ask BugRater to submit itReports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.
Program metrics
HackerOne, published
These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 9 Nov 2026.
What it pays, by severity
Critical
no reports on record
High
no reports on record
Medium
no reports on record
Low
no reports on record
Intake & responsiveness, last 90 days
Reports received
1,887
in 90 days
Resolved
2,736
all time, last one 4 days ago
Participants
1,362
hunters engaged
Response efficiency
60%
below its own targets, HackerOne’s figure
SLA misses
0
targets missed
Reports received, day by day, last 30 days
1,666–1,887
10 Oct
1,887 reports
9 Nov
Response targets it sets itself
First response
1 day
Triage
5 days
Bounty
30 days
Resolution
30 days
These are targets the program set. They don't show whether it meets them.
Barriers to submitting
bounty amounts hidden
Over 79 days (58 snapshots): intake up 819 reports; response efficiency down 30 points.
See how this program’s report load compares to others
Reviews
0 publishedNo reviews yet.
Who this program credits
1,427 creditedResearchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.
| # | Researcher | Reputation | Recognised / submitted |
|---|---|---|---|
| 1 | h0nith12 | 3,505 | 143 / 247 58% |
| 2 | mo7mead | 2,680 | 67 / 308 22% |
| 3 | worstwursts | 1,609 | 24 / 42 57% |
| 4 | ganeshbagaria | 1,574 | 56 / 86 65% |
| 5 | 696e746c6f6c | 1,569 | 58 / 95 61% |
| 6 | itz_mg | 1,469 | 54 / 93 58% |
| 7 | ayush1098 | 1,083 | 26 / 36 72% |
| 8 | buraaqsec | 1,036 | 40 / 54 74% |
| 8 | samuelhuntley | 118 | 3 / 9 33% |
| 9 | zseano | 1,000 | 22 / 25 88% |
| 10 | proper-lay | 958 | 49 / 72 68% |
| 11 | g0ndaar | 954 | 33 / 53 62% |
| 12 | ha4x0r | 898 | 24 / 64 38% |
| 13 | orion1x1 | 894 | 27 / 42 64% |
| 13 | 40826d | 142 | 6 / 9 67% |
| 14 | comwrg | 883 | 34 / 37 92% |
| 15 | defyourtype | 875 | 51 / 145 35% |
| 16 | yash_005 | 748 | 19 / 65 29% |
| 17 | geloyz | 744 | 17 / 118 14% |
| 18 | gxbnt | 737 | 8 / 16 50% |
| 19 | mrxhunt | 736 | 20 / 58 34% |
| 20 | milankatwal99 | 732 | 47 / 65 72% |
| 21 | gr3pme | 730 | 19 / 35 54% |
| 21 | authd0wn | 7 | 1 / 2 50% |
| 22 | sachin_kr | 720 | 27 / 49 55% |
Showing the top 25 of 1,427 credited on HackerOne.
Program profile
HackerOne, imported
HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 8 Nov 2026.
Responsiveness
60% HackerOne’s figure
Swag
Offered
Currency
USD
Submissions
Open
Launched
Apr 2020
Scope entries
253 HackerOne’s count
Scope
243 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.amazon.ae | WILDCARD | ✓ bounty | Critical |
| *.amazon.ca | WILDCARD | ✓ bounty | Critical |
| *.amazon.cl | WILDCARD | ✓ bounty | Critical |
| *.amazon.cn | WILDCARD | ✓ bounty | Critical |
| *.amazon.co.jp | WILDCARD | ✓ bounty | Critical |
Show all 243 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.amazon.co.uk | WILDCARD | ✓ bounty | Critical |
| *.amazon.co.za | WILDCARD | ✓ bounty | Critical |
| *.amazon.com | WILDCARD | ✓ bounty | Critical |
| *.amazon.com.au | WILDCARD | ✓ bounty | Critical |
| *.amazon.com.be | WILDCARD | ✓ bounty | Critical |
| *.amazon.com.br | WILDCARD | ✓ bounty | Critical |
| *.amazon.com.co | WILDCARD | ✓ bounty | Critical |
| *.amazon.com.mx | WILDCARD | ✓ bounty | Critical |
| *.amazon.com.ng | WILDCARD | ✓ bounty | Critical |
| *.amazon.com.tr | WILDCARD | ✓ bounty | Critical |
| *.amazon.de | WILDCARD | ✓ bounty | Critical |
| *.amazon.eg | WILDCARD | ✓ bounty | Critical |
| *.amazon.es | WILDCARD | ✓ bounty | Critical |
| *.amazon.fr | WILDCARD | ✓ bounty | Critical |
| *.amazon.in | WILDCARD | ✓ bounty | Critical |
| *.amazon.it | WILDCARD | ✓ bounty | Critical |
| *.amazon.nl | WILDCARD | ✓ bounty | Critical |
| *.amazon.pl | WILDCARD | ✓ bounty | Critical |
| *.amazon.sa | WILDCARD | ✓ bounty | Critical |
| *.amazon.se | WILDCARD | ✓ bounty | Critical |
| *.amazon.sg | WILDCARD | ✓ bounty | Critical |
| a4k.amazon.com | URL | ✓ bounty | Critical |
| aax-us-iad.amazon.com | URL | ✓ bounty | Critical |
| aca-livecards-service.amazon.com | URL | ✓ bounty | Critical |
| address-photos.amazon.com | URL | ✓ bounty | Critical |
| ads-setu-proxy.amazon.com | URL | ✓ bounty | Critical |
| advertising-api.amazon.com | URL | ✓ bounty | Critical |
| advertising.amazon.com | URL | ✓ bounty | Critical |
| affiliate-program.amazon.com | URL | ✓ bounty | Critical |
| alexa-comms-mobile-service-na.amazon.com | URL | ✓ bounty | Critical |
| amazon.speech.sim | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| amazonpayinsurance.in | URL | ✓ bounty | Critical |
| apay-us.amazon.com | URL | ✓ bounty | Critical |
| api.amazon.com | URL | ✓ bounty | Critical |
| appstore-tv-prod-na.amazon.com | URL | ✓ bounty | Critical |
| av-na.amazon.com | URL | ✓ bounty | Critical |
| chat.amazon.com | URL | ✓ bounty | Critical |
| cloudaccesstelemetry-us-east-1.amazon.com | URL | ✓ bounty | Critical |
| com.amazon.aba.application | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.amazonone.androidapp | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.amazonvideo.livingroom | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.astro | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.avod.thirdpartyclient | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.clouddrive.photos | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.dee.alexaonwearos | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.dee.app | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.enterprise.access.android | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.firetv.recast.blaster.aosp | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.flex.rabbit | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.helix.prod | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.ihm.candycane | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.imdb.tv.mobile.app | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.kindle | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.kisan.app | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.minitv.android.app | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.mp3 | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.mp3.automotiveOS | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.mShop.android.business.shopping | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.music.tv | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.primenow.seller.android | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.relay | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.sellerflexmobile | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.sellermobile.android | OTHER APK | ✓ bounty | Critical |
| com.amazon.sft.rangoli.seller.app | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.shopperpanel.android.mobile.app | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.storm.lightning.client.aosp | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.swa.mobileapp | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.tahoe.freetime | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.tahoe.grownups | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.tails | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.technician.android | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.vendormobile.android | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.vendormobile.india.android | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.warhol.android | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.amazon.ziggy.android | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.eero.android | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.imdbtv.livingroom | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.immediasemi.android.blink | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.localqueen | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.ring.neighborhoods | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.ringapp | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.zappos.android | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| com.zappos.android.sixpmFlavor | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| completion.amazon.com | URL | ✓ bounty | Critical |
| cscentral.amazon.com | URL | ✓ bounty | Critical |
| data-na.amazon.com | URL | ✓ bounty | Critical |
| dcape-na.amazon.com | URL | ✓ bounty | Critical |
| Devices | OTHER | ✓ bounty | None |
| dna.amazon.com | URL | ✓ bounty | Critical |
| dolphin.amazon.com | URL | ✓ bounty | Critical |
| dss-na.amazon.com | URL | ✓ bounty | Critical |
| dv-manifest-service-na-prod.amazon.com | URL | ✓ bounty | Critical |
| Echo Family Devices | HARDWARE | ✓ bounty | Critical |
| FireTV | HARDWARE | ✓ bounty | Critical |
| flex-capacity-na.amazon.com | URL | ✓ bounty | Critical |
| flex.amazon.* | URL | ✓ bounty | Critical |
| freight.amazon.* | URL | ✓ bounty | Critical |
| fresh.amazon.* | URL | ✓ bounty | Critical |
| ftvmps-na.amazon.com | URL | ✓ bounty | Critical |
| ftvpes-na.amazon.com | URL | ✓ bounty | Critical |
| ftvr-na.amazon.com | URL | ✓ bounty | Critical |
| ftvsacs-na.amazon.com | URL | ✓ bounty | Critical |
| gateway-ink.amazon.com | URL | ✓ bounty | Critical |
| GenAI Apps under *.amazon.* | AI MODEL | ✓ bounty | Critical |
| http://www.amazon.com/cpe/yourpayments/wallet | URL | ✓ bounty | Critical |
| https://amazonpay.amazon.in/* | URL | ✓ bounty | Critical |
| https://www.amazon.com/amazoncash | URL | ✓ bounty | Critical |
| https://www.amazon.com/dppui/* | URL | ✓ bounty | Critical |
| https://www.amazon.com/gp/buy/* | URL | ✓ bounty | Critical |
| https://www.amazon.in/amazonpay/home | URL | ✓ bounty | Critical |
| https://www.amazon.in/wealth/* | URL | ✓ bounty | Critical |
| https://www.amazonpay.in/* | OTHER | ✓ bounty | Critical |
| imdbtv-backend-na.amazon.com | URL | ✓ bounty | Critical |
| in.amazon.mShop.android.business.shopping | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| in.amazon.mShop.android.shopping | GOOGLE PLAY APP ID | ✓ bounty | Critical |
| kca.amazon.com | URL | ✓ bounty | Critical |
| Kindle E-Reader | HARDWARE | ✓ bounty | Critical |
| kwis-opf.amazon.com | URL | ✓ bounty | Critical |
| logistics.amazon.* | URL | ✓ bounty | Critical |
| Luna | HARDWARE | ✓ bounty | Critical |
| mag-na.amazon.com | URL | ✓ bounty | Critical |
| manufacturing.amazon.* | URL | ✓ bounty | Critical |
| manufacturing.amazon.com | URL | ✓ bounty | Critical |
| mas-ext.amazon.com | URL | ✓ bounty | Critical |
| mas-sdk.amazon.com | URL | ✓ bounty | Critical |
| merch.amazon.com | URL | ✓ bounty | Critical |
| mlis.amazon.com | URL | ✓ bounty | Critical |
| msh.amazon.com | URL | ✓ bounty | Critical |
| music-api.amazon.com | URL | ✓ bounty | Critical |
| music-hints-na.amazon.com | URL | ✓ bounty | Critical |
| music-xray-service.amazon.com | URL | ✓ bounty | Critical |
| music.amazon.com | URL | ✓ bounty | Critical |
| musicapp.amazon.com | URL | ✓ bounty | Critical |
| musiccentral.amazon.com | URL | ✓ bounty | Critical |
| na.account.amazon.com | URL | ✓ bounty | Critical |
| org.amazon.* | URL | ✓ bounty | Critical |
| paragon-na.amazon.com | URL | ✓ bounty | Critical |
| pay.amazon.* | URL | ✓ bounty | Critical |
| payments.amazon.* | URL | ✓ bounty | Critical |
| photos.amazon.* | URL | ✓ bounty | Critical |
| pitangui.amazon.com | URL | ✓ bounty | Critical |
| preview-flex-capacity-na.amazon.com | URL | ✓ bounty | Critical |
| prime.amazon.* | URL | ✓ bounty | Critical |
| primenow.amazon.* | URL | ✓ bounty | Critical |
| primevideo.com/* | WILDCARD | ✓ bounty | Critical |
| prod-dp-discovery-us-east-1.amazon.com | URL | ✓ bounty | Critical |
| rabbitinstruction-na.amazon.com | URL | ✓ bounty | Critical |
| read.amazon.com | URL | ✓ bounty | Critical |
| relay.amazon.com | URL | ✓ bounty | Critical |
| sellercentral.amazon.com | URL | ✓ bounty | Critical |
| Services/Mobile/GenAI | OTHER | ✓ bounty | None |
| shopbylook.amazon.* | URL | ✓ bounty | Critical |
| smile.amazon.* | URL | ✓ bounty | Critical |
| spapi-na.amazon.com | URL | ✓ bounty | Critical |
| Tablets | HARDWARE | ✓ bounty | Critical |
| track.amazon.com | URL | ✓ bounty | Critical |
| updates.amazon.com | URL | ✓ bounty | Critical |
| Vega OS | OTHER | ✓ bounty | Critical |
| www.amazon.* | URL | ✓ bounty | Critical |
| www.amazon.ca | URL | ✓ bounty | Critical |
| www.amazon.co.jp | URL | ✓ bounty | Critical |
| www.amazon.co.uk | URL | ✓ bounty | Critical |
| www.amazon.com.au | URL | ✓ bounty | Critical |
| www.amazon.com.br | URL | ✓ bounty | Critical |
| www.amazon.com.mx | URL | ✓ bounty | Critical |
| www.amazon.de | URL | ✓ bounty | Critical |
| www.amazon.es | URL | ✓ bounty | Critical |
| www.amazon.fr | URL | ✓ bounty | Critical |
| www.amazon.in | URL | ✓ bounty | Critical |
| www.amazon.in specific areas of note | OTHER | ✓ bounty | Critical |
| www.amazon.it | URL | ✓ bounty | Critical |
| www.amazon.nl | URL | ✓ bounty | Critical |
| "Contact Us" Functionality | OTHER | out | None |
| *.*a2z*.* | OTHER | out | None |
| *.aws.* | OTHER | out | None |
| *.dev | OTHER | out | None |
| Amazon Developer | OTHER | out | None |
| Amazon Go/Whole Foods | OTHER | out | None |
| Amazon Music | OTHER | out | None |
| Amazon Physical Stores | OTHER | out | None |
| Amazon Subsidiaries | OTHER | out | None |
| Amazon Subsidiaries (Please only actively test explicitly stated scope) | OTHER | submit only | Critical |
| Amazon Web Services (AWS) | OTHER | out | None |
| amazongames.com | URL | out | None |
| Anything considered a non-prod asset | OTHER | out | None |
| Anything which redirects to AWS | OTHER | out | None |
| authorcentral.amazon.com | URL | out | None |
| AWS and AWS customer assets are strictly out of scope | OTHER | out | None |
| com.amazon.Amazon | APPLE STORE APP ID | submit only | Critical |
| com.amazon.mShop.android.shopping | GOOGLE PLAY APP ID | submit only | Critical |
| learning.logistics.amazon.com | OTHER | out | None |
| Other Amazon Retail Assets (Please only actively test explicitly stated scope) | OTHER | submit only | Critical |
| Other Amazon Retail Mobile Apps (Please only actively test explicitly stated scope) | OTHER | submit only | Critical |
| Other Amazon Retail Sites (Please only actively test explicitly stated scope) | OTHER | submit only | Critical |
| tsologic.com | URL | out | None |
| www.amazon.com | URL | submit only | Critical |
| www.twitch.tv | URL | out | None |
| 1013961111 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1023499075 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1057338687 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1068014324 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1151746202 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1218902777 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1265170914 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1276296103 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1324809509 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1454725763 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1475021574 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1478350915 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1494755014 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1498197033 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1528364633 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1532153219 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1552455423 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1579372261 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1592204907 | APPLE STORE APP ID | ✓ bounty | Critical |
| 1659883691 | APPLE STORE APP ID | ✓ bounty | Critical |
| 297606951 | APPLE STORE APP ID | ✓ bounty | Critical |
| 302584613 | APPLE STORE APP ID | ✓ bounty | Critical |
| 335187483 | APPLE STORE APP ID | ✓ bounty | Critical |
| 342576766 | APPLE STORE APP ID | ✓ bounty | Critical |
| 348712880 | APPLE STORE APP ID | ✓ bounty | Critical |
| 358861688 | APPLE STORE APP ID | ✓ bounty | Critical |
| 374254473 | APPLE STORE APP ID | ✓ bounty | Critical |
| 392988420 | APPLE STORE APP ID | ✓ bounty | Critical |
| 510855668 | APPLE STORE APP ID | ✓ bounty | Critical |
| 545519333 | APPLE STORE APP ID | ✓ bounty | Critical |
| 621574163 | APPLE STORE APP ID | ✓ bounty | Critical |
| 6444868926 | APPLE STORE APP ID | ✓ bounty | Critical |
| 6452192521 | APPLE STORE APP ID | ✓ bounty | Critical |
| 6471528064 | APPLE STORE APP ID | ✓ bounty | Critical |
| 6479334468 | APPLE STORE APP ID | ✓ bounty | Critical |
| 6560104638 | APPLE STORE APP ID | ✓ bounty | Critical |
| 794141485 | APPLE STORE APP ID | ✓ bounty | Critical |
| 926252661 | APPLE STORE APP ID | ✓ bounty | Critical |
| 944011620 | APPLE STORE APP ID | ✓ bounty | Critical |
| 947984433 | APPLE STORE APP ID | ✓ bounty | Critical |
| 988788863 | APPLE STORE APP ID | ✓ bounty | Critical |
HackerOne lists 253 scope entries. Its public listing groups many assets under one label, so we show identical entries once.