Chime Managed Bug Bounty Engagement

Bugcrowd published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 6 Nov 2026.

Introduction Welcome to Chime’s Bug Bounty Program! As a fintech leader, security is at the heart of everything we do. We’re committed to providing our members with a safe, reliable banking experience, and your expertise as a security researcher plays a vital role in making that possible. At Chime, our mission is to bring financial peace of mind to everyone. We’ve helped millions of Americans by removing unnecessary fees, enabling automatic savings, and offering financial wellness features such as fee-free overdrafts, early paycheck access through MyPay, credit building tools, and Chime at Workplace. These benefits only matter if they’re secure, and that’s where you come in. By participating in our bug bounty program, you’re helping us stay ahead of emerging threats, protect our members, and uphold the trust they place in us. Thank you for collaborating with us to make Chime even more secure. High-Value Focus Areas We strongly encourage researchers to direct testing toward high-impact business logic and mobile endpoints: GraphQL Implementations: Query complexity abuses, broken object-level authorization (BOLA/IDOR), and field-level permission bypasses. Mobile Applications (iOS & Android): Security flaws in native endpoints, session storage, and IPC mechanisms on non-rooted/non-jailbroken devices. Money Movement & Ledger Integrity: Bypassing daily/monthly transfer limits, race conditions/retry logic leading to financial advantage (e.g., double spending), and UI vs. backend balance desynchronization. Identity & Account Lifecycle: Skipping KYC/activation steps to achieve a funded account state, referral/rew Severity Determination We use a combination of Impact and Exploitability to determine final severity​: If a vulnerability could directly affect finances or sensitive data for many users, it will likely be Critical. If it affects individual users or non-sensitive data, it may be High or Medium. If it requires unlikely user interaction or has mitigations in place (e.g., a theoretical bug that can't be exploited easily), it may be Low or even Informational. We will communicate our severity reasoning when triaging your report. If you believe we misclassified something, we are open to dialogue – our goal is to be fair and consistent. What's in Scope All Chime-owned assets and services are in scope unless explicitly listed as Out of Scope. Testing is permitted across production and QA/development environments per the testing guidelines. If an unlisted asset demonstrably belongs to Chime, you may report it; however, it will be handled as vulnerability disclosure only and is ineligible for bounties or points. Disclosure Policy Respect confidentiality: Please do not discuss or publicize vulnerabilities found in this program. This includes both vulnerabilities that are still being triaged and those that have been resolved. If in doubt, ask our team for clarification before sharing any information. Participation Criteria By participating, you represent that you (i) are at least 18 years old, (ii) are not located in, organized under the laws of, or ordinarily resident in a jurisdiction subject to comprehensive U.S. sanctions, (iii) are not identified on the U.S. Treasury Department’s Specially Designated Nationals and Blocked Persons List (“SDN List”) or any other U.S. restricted-party list, and (iv) are not, and are not owned or controlled (>50 %), by any person or entity designated on the U.S. Department of Commerce Entity List, Unverified List, or Military End-User List, or otherwise subject to U.S. export-control restrictions. You may not submit vulnerability reports while physically present in any jurisdiction subject to comprehensive U.S. sanctions. You must not be a current employee or immediate family member of Chime or any third party managing Chime’s digital assets or infrastructure. Engagement Guidelines General Rules Submit One Vulnerability Per Report: If multiple bugs must be chained to show impact, explain the full chain clearly in a single submission. One Fix = One Bounty: Multiple endpoints or parameters sharing the exact same root cause will be awarded a single bounty as duplicates. Reproducibility: Reports must contain clear, step-by-step instructions or PoC code. Unreproducible reports will be marked ineligible. Account Interaction: Only interact with accounts you own or have explicit permission to test. Stop immediately and report if you encounter another member's sensitive PII. No Targeting: Do not target Chime employees, contractors, or real members during testing. Examples of Valid Vulnerabilities To help you focus on impactful findings, here are examples of vulnerabilities in different severity categories. These examples illustrate the kinds of issues we consider critical, high, medium, or low severity. This is not an exhaustive list, but a guideline. We assess severity case-by-case based on impact and exploitability. Severity Determination Guidelines Critical (P1): Direct compromise of sensitive data, funds, or infrastructure; multi-user/systemic impact (e.g., unauthorized fund transfers, double-spend race conditions, production RCE, SSN leaks, critical SQLi, AWS SSRF). High (P2): Single-user account takeover (ATO), non-production RCE, single-user PII exposure, access control flaws affecting an isolated user account. Medium (P3): Limited non-sensitive information exposure (e.g., email address enumeration, viewing limited non-financial account details). Low (P4): Low-impact issues with minimal exploitability (e.g., non-critical subdomain takeovers without escalation paths). Program Exclusions When reporting vulnerabilities, please consider (1) the attack scenario/exploitability, and (2) the security impact of the bug. The following issues are considered out of scope: Out-of-Scope Vulnerabilities & Assets Out-of-Scope Vulnerabilities Debug information disclosures without sensitive data, stack traces, or software version/banner disclosure. Missing security b