# Mastercard Public Bug Bounty: bug bounty program on Bugcrowd

> Mastercard Public Bug Bounty is a bug bounty program on Bugcrowd. Bounties range from $50 to $5,000. 21 assets are listed in scope, 21 of them bounty-eligible.

- **Company:** Mastercard Public Bug Bounty
- **Platform:** Bugcrowd
- **Program page:** /engagements/mastercard
- **Pays bounties:** yes
- **Submissions:** open
- **Bounty range:** $50 to $5,000
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/mastercard

## Scope

As imported from Bugcrowd on November 6, 2026: 21 assets in scope (21 bounty-eligible), 0 out of scope. The policy page is the authority.

- `Core Priceless.com - demo.priceless.com` (website): in scope, bounty-eligible
- `Finicity - OBB (Open Banking Business Service)` (api): in scope, bounty-eligible
- `Finicity Connect` (api): in scope, bounty-eligible
- `Finicity Decisioning` (api): in scope, bounty-eligible
- `Finicity- Data Services` (api): in scope, bounty-eligible
- `Finicity- Open Banking Payment History application` (api): in scope, bounty-eligible
- `https://consumer.finicityreports.com` (website): in scope, bounty-eligible
- `https://developer.mastercard.com` (website): in scope, bounty-eligible
- `https://performancemarketing.mastercard.com/portal/` (website): in scope, bounty-eligible
- `https://pioneer.truata.com/` (website): in scope, bounty-eligible
- `https://priceless.com/golf/` (website): in scope, bounty-eligible
- `https://src.mastercard.com/*` (website): in scope, bounty-eligible
- `https://src.mastercard.com/profile/enroll` (website): in scope, bounty-eligible
- `https://www.finicity.com` (website): in scope, bounty-eligible
- `MasterCard.ch - (French) - www.mastercard.ch/fr-ch.html` (website): in scope, bounty-eligible
- `MasterCard.ch - (German) - www.mastercard.ch/de-ch.html` (website): in scope, bounty-eligible
- `MasterCard.com.au - www.mastercard.com.au/en-au.html` (website): in scope, bounty-eligible
- `MasterCard.nl - www.mastercard.nl/nl-nl.html` (website): in scope, bounty-eligible
- `MasterCard.us - www.mastercard.us/en-us.html` (website): in scope, bounty-eligible
- `Public Others Target` (other): in scope, bounty-eligible
- `SRC integration on https://masterpassteststore.com/. Only the Masterpass checkout functionality is in scope` (website): in scope, bounty-eligible

## Recent public accepted findings

- November 6, 2026: medium severity on Public Others Target, awarded $135
- November 6, 2026: low severity on Public Others Target, awarded $45
- November 6, 2026: low severity on Public Others Target
- November 6, 2026: critical severity, awarded $700
- November 6, 2026: medium severity on Public Others Target

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.