# EXNESS: bug bounty program on HackerOne

> EXNESS is a bug bounty program on HackerOne. Its critical reports have paid an average of $15,000 across 8 reports (HackerOne figures, November 6, 2026). It received 103 reports in the 90 days to November 6, 2026, about 1.6 per in-scope asset.

- **Company:** EXNESS
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/exness
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** March 16, 2022
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/exness

## Payouts and volume

HackerOne's own published figures, captured November 6, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $15,000 | 8 |
| High | $2,920 | 28 |
| Medium | $459 | 110 |
| Low | $225 | 373 |

- Reports received in the last 90 days: 103 (about 1.6 per in-scope asset)
- Bounties paid in the last 90 days: $99,074
- Bounties paid in total: $603,206
- Researchers participating: 342
- Response efficiency: 89%
- First-response target: 1 day
- Triage target: 5 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 65 assets in scope (61 bounty-eligible), 10 out of scope. The policy page is the authority.

- `173.0.152.64/28` (CIDR): in scope, bounty-eligible, max severity high
- `185.170.234.32/28` (CIDR): in scope, bounty-eligible, max severity low
- `193.194.116.0/22` (CIDR): in scope, bounty-eligible, max severity critical
- `203.121.22.32/28` (CIDR): in scope, bounty-eligible, max severity low
- `210.19.168.196/30` (CIDR): in scope, bounty-eligible, max severity low
- `221.133.43.0/30` (CIDR): in scope, bounty-eligible, max severity low
- `223.27.131.168/29` (CIDR): in scope, bounty-eligible, max severity low
- `91.184.201.0/29` (CIDR): in scope, bounty-eligible, max severity medium
- `admin.exness.com` (URL): in scope, bounty-eligible, max severity critical
- `amazon-dsn-processor.exness.com` (URL): in scope, bounty-eligible, max severity low
- `api.excalls.mobi` (URL): in scope, bounty-eligible, max severity critical
- `api.exness.com` (URL): in scope, bounty-eligible, max severity critical
- `beatbot.exness.com` (URL): in scope, bounty-eligible, max severity high
- `bonus-stats.exness.com` (URL): in scope, bounty-eligible, max severity medium
- `chat-mapper.exness.com` (URL): in scope, bounty-eligible, max severity high
- `com.exness.android.pa` (OTHER_APK): in scope, bounty-eligible, max severity critical
- `com.exness.investments` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity medium
- `com.exness.investor` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `com.exness.trader.watch` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity medium
- `Exness Investor` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `Exness Social Trading` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity medium
- `Exness Trade: Online Trading` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `exness.bar` (URL): in scope, bounty-eligible, max severity medium
- `exness.com` (URL): in scope, bounty-eligible, max severity medium
- `exnessaffiliates.com` (URL): in scope, bounty-eligible, max severity critical
- `files.exness.co` (URL): in scope, bounty-eligible, max severity critical
- `http://185.170.234.32/28` (URL): in scope, bounty-eligible, max severity low
- `https://my.exness.com/pa/pim/manager` (URL): in scope, bounty-eligible, max severity high
- `https://my.exness.com/pa/socialtrading` (URL): in scope, bounty-eligible, max severity medium
- `https://my.exness.com/webtrading/` (URL): in scope, bounty-eligible, max severity critical
- `hubspot-forms.exness.com` (URL): in scope, bounty-eligible, max severity medium
- `Logical trading issues` (OTHER): in scope, bounty-eligible, max severity critical
- `msg.exness.com` (URL): in scope, bounty-eligible, max severity critical
- `mypartner.exness.com` (URL): in scope, bounty-eligible, max severity critical
- `ng.exness.com` (URL): in scope, bounty-eligible, max severity none
- `ng2.exness.com` (URL): in scope, bounty-eligible, max severity none
- `partner.exness.com` (URL): in scope, bounty-eligible, max severity critical
- `Partnership` (OTHER): in scope, bounty-eligible, max severity critical
- `pay.ibex.exchange` (URL): in scope, bounty-eligible, max severity critical
- `Personal Area for Web Trading` (OTHER): in scope, bounty-eligible, max severity critical
- and 35 more on the BugRater page

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.