In brief. EXNESS is a bug bounty program on HackerOne. Its critical reports have paid an average of $15,000 across 8 reports (HackerOne figures, November 6, 2026). It received 103 reports in the 90 days to November 6, 2026, about 1.6 per in-scope asset. As of Nov 6, 2026. Markdown for agents

NR Unrated

EXNESS

EXNESS HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at EXNESS? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 6 Nov 2026.

What it pays, by severity

Critical $15,000 avg 8 reports indicative

High $2,920 avg 28 reports firm

Medium $459 avg 110 reports firm

Low $225 avg 373 reports firm

$603,206 paid to researchers in total, $99,074 of it in the last 90 days. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received

103

in 90 days

Resolved

532

all time, last one 10 days ago

Participants

342

hunters engaged

Response efficiency

89%

meeting its targets, HackerOne’s figure

SLA misses

targets missed

Reports received, day by day, last 29 days 95–117

9 Oct 103 reports 6 Nov

Response targets it sets itself

First response

1 day

Triage

5 days

Bounty

30 days

Resolution

180 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

Open to submit. HackerOne lists no requirements for submitting a report here.

Over 77 days (53 snapshots): intake down 34 reports; response efficiency down 10 points; 90-day payout up $16,638.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

363 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	nismo	3,614	137 / 179 77%
2	ashwarya	2,012	60 / 95 63%
2	gujjuboy10x00	650	28 / 48 58%
3	sheikhrishad0	493	15 / 18 83%
4	todayisnew	430	17 / 73 23%
5	pprab	357	0 / 2 0%
6	artsec	319	4 / 18 22%
7	annonimous254	250	10 / 31 32%
8	agate_	224	0 / 0
8	vibonacci	224	0 / 9 0%
10	m0chan	213	12 / 12 100%
11	williamhanugra	199	0 / 0
12	padmak	198	6 / 8 75%
13	thsa	191	8 / 9 89%
14	hakluke	190	5 / 5 100%
14	lauritz	190	1 / 7 14%
16	tefa_	176	7 / 15 47%
17	badf00d	171	3 / 3 100%
18	khaled_hammad	167	6 / 12 50%
19	ahmd_halabi	160	12 / 23 52%
19	krevetk0	160	3 / 4 75%
21	thewhiteone	147	0 / 8 0%
22	alpha66	144	8 / 17 47%
23	orion1x1	132	3 / 9 33%
24	s3c	129	4 / 9 44%

Showing the top 25 of 363 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 6 Nov 2026.

We offer better-than-market conditions on currencies, crypto, stocks, indices, metals, and commodities.

Responsiveness

89% HackerOne’s figure

Swag

Offered

Currency

USD

Submissions

Open

Launched

Mar 2022

Scope entries

79 HackerOne’s count

Scope

75 assets

Asset	Type	Eligibility	Max severity
173.0.152.64/28	CIDR	✓ bounty	High
185.170.234.32/28	CIDR	✓ bounty	Low
193.194.116.0/22	CIDR	✓ bounty	Critical
203.121.22.32/28	CIDR	✓ bounty	Low
210.19.168.196/30	CIDR	✓ bounty	Low

Show all 75 assets

Asset	Type	Eligibility	Max severity
221.133.43.0/30	CIDR	✓ bounty	Low
223.27.131.168/29	CIDR	✓ bounty	Low
91.184.201.0/29	CIDR	✓ bounty	Medium
admin.exness.com	URL	✓ bounty	Critical
amazon-dsn-processor.exness.com	URL	✓ bounty	Low
api.excalls.mobi	URL	✓ bounty	Critical
api.exness.com	URL	✓ bounty	Critical
beatbot.exness.com	URL	✓ bounty	High
bonus-stats.exness.com	URL	✓ bounty	Medium
chat-mapper.exness.com	URL	✓ bounty	High
com.exness.android.pa	OTHER APK	✓ bounty	Critical
com.exness.investments	GOOGLE PLAY APP ID	✓ bounty	Medium
com.exness.investor	GOOGLE PLAY APP ID	✓ bounty	Critical
com.exness.trader.watch	GOOGLE PLAY APP ID	✓ bounty	Medium
Exness Investor	APPLE STORE APP ID	✓ bounty	Critical
Exness Social Trading	APPLE STORE APP ID	✓ bounty	Medium
Exness Trade: Online Trading	APPLE STORE APP ID	✓ bounty	Critical
exness.bar	URL	✓ bounty	Medium
exness.com	URL	✓ bounty	Medium
exnessaffiliates.com	URL	✓ bounty	Critical
files.exness.co	URL	✓ bounty	Critical
http://185.170.234.32/28	URL	✓ bounty	Low
https://my.exness.com/pa/pim/manager	URL	✓ bounty	High
https://my.exness.com/pa/socialtrading	URL	✓ bounty	Medium
https://my.exness.com/webtrading/	URL	✓ bounty	Critical
hubspot-forms.exness.com	URL	✓ bounty	Medium
Logical trading issues	OTHER	✓ bounty	Critical
msg.exness.com	URL	✓ bounty	Critical
mypartner.exness.com	URL	✓ bounty	Critical
ng.exness.com	URL	✓ bounty	None
ng2.exness.com	URL	✓ bounty	None
partner.exness.com	URL	✓ bounty	Critical
Partnership	OTHER	✓ bounty	Critical
pay.ibex.exchange	URL	✓ bounty	Critical
Personal Area for Web Trading	OTHER	✓ bounty	Critical
Portfolio Management	OTHER	✓ bounty	High
Public Area for Web Trading	OTHER	✓ bounty	Medium
pwapi.ex2b.com	URL	✓ bounty	Critical
quotes.exness.com	URL	✓ bounty	Medium
sf-magic.exness.com	URL	✓ bounty	High
sip.exness.com	URL	✓ bounty	Critical
Social Trading	OTHER	✓ bounty	Medium
social-trading.exness.com	URL	✓ bounty	Medium
static.exness.com	URL	✓ bounty	Low
ticks.exness.com	URL	✓ bounty	Medium
vpn.exness.com	URL	✓ bounty	Medium
Web Terminal	OTHER	✓ bounty	Critical
www.exness-careers.com	URL	✓ bounty	Low
www.exness.cn	URL	✓ bounty	Critical
www.exness.com	URL	✓ bounty	Critical
www.exness.ru	URL	✓ bounty	Critical
www.exnessaffiliates.com	URL	✓ bounty	Critical
*.exness.tld	WILDCARD	submit only	Critical
Any subdomain application issue	OTHER	submit only	Critical
Any subdomain infrastructure issue	OTHER	submit only	Critical
External service data leakage	OTHER	submit only	Critical
hubspot-forms.exness.asia	URL	out	None
hubspot-forms.exness.co.id	URL	out	None
my.exness.com	URL	out	None
mypartner.exness.co.id	URL	out	None
stat.* (e.g. stat.exnessaffiliates.com)	URL	out	None
www.exness.asia	URL	out	None
www.exness.co.id	URL	out	None
www.exness.eu	URL	out	None
www.exness.uk	URL	out	None
www.exness.web.id	URL	out	None
1359763701	APPLE STORE APP ID	✓ bounty	Critical
1392465628	APPLE STORE APP ID	✓ bounty	Medium
1474969251	APPLE STORE APP ID	✓ bounty	Medium
1579331769	APPLE STORE APP ID	✓ bounty	Critical

HackerOne lists 79 scope entries. Its public listing groups many assets under one label, so we show identical entries once.