# d-you App & German EUDI Wallet Ecosystem: bug bounty program on HackerOne

> d-you App & German EUDI Wallet Ecosystem is a bug bounty program on HackerOne. Its critical reports have paid an average of $6,000 (HackerOne figures, November 6, 2026). It received 1,120 reports in the 90 days to November 6, 2026, about 80 per in-scope asset.

- **Company:** d-you App & German EUDI Wallet Ecosystem
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/common_codes
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** September 16, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/common-codes

## Payouts and volume

HackerOne's own published figures, captured November 6, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $6,000 | not published |
| High | $4,000 | not published |

- Reports received in the last 90 days: 1,120 (about 80 per in-scope asset)
- Bounties paid in the last 90 days: $10,000
- Bounties paid in total: $10,000
- Researchers participating: 6
- Response efficiency: 87%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days
- Barriers: ID verification required

## Scope

As imported from HackerOne on November 6, 2026: 14 assets in scope (14 bounty-eligible), 4 out of scope. The policy page is the authority.

- `d-you Android test` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `d-you iOS test` (TESTFLIGHT): in scope, bounty-eligible, max severity critical
- `d-you Wallet Android Test` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `d-you Wallet iOS Test` (TESTFLIGHT): in scope, bounty-eligible, max severity critical
- `https://github.com/german-national-wallet/de-eudi-wallet-backend` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://groups.google.com/g/de-eudi-bug-bounty/` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `https://test.api.example.com` (API): in scope, bounty-eligible, max severity critical
- `https://testflight.apple.com/join/a2Qxrr2C` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/status-lists` (API): in scope, bounty-eligible, max severity critical
- `https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/mdvm` (API): in scope, bounty-eligible, max severity critical
- `https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/pns` (API): in scope, bounty-eligible, max severity high
- `https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/rwsca` (API): in scope, bounty-eligible, max severity critical
- `https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/status-lists` (API): in scope, bounty-eligible, max severity critical
- `https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/wpb` (API): in scope, bounty-eligible, max severity critical
- `bundesdruckerei.de` (URL): out of scope, max severity none
- `OOS: All domains from [*.]bundesdruckerei.de` (API): out of scope, max severity none
- `OOS: All other domains from [*.]youniqx.com` (API): out of scope, max severity none
- `youniqx.com` (URL): out of scope, max severity none

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.