# Meesho: bug bounty program on HackerOne

> Meesho is a bug bounty program on HackerOne. Its critical reports have paid an average of $1,800 across 4 reports (HackerOne figures, November 7, 2026). It received 188 reports in the 90 days to November 7, 2026, about 13 per in-scope asset.

- **Company:** Meesho
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/meesho_bbp
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** February 11, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/meesho-bbp

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $1,800 | 4 |
| High | $500 | 10 |
| Medium | $518 | 19 |
| Low | $133 | 25 |

- Reports received in the last 90 days: 188 (about 13 per in-scope asset)
- Bounties paid in the last 90 days: $3,735
- Bounties paid in total: $21,125
- Researchers participating: 87
- Response efficiency: 69%
- First-response target: 5 days
- Triage target: 10 days
- Bounty target: 45 days

## Scope

As imported from HackerOne on November 6, 2026: 14 assets in scope (14 bounty-eligible), 19 out of scope. The policy page is the authority.

- `admin.meeshosupply.com` (URL): in scope, bounty-eligible, max severity critical
- `affiliate.meesho.com` (URL): in scope, bounty-eligible, max severity critical
- `com.meesho.supply` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `com.valmo.ops` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity none
- `com.valmo.rider` (OTHER): in scope, bounty-eligible, max severity none
- `com.valmo.valmo` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `investor.meesho.com` (URL): in scope, bounty-eligible, max severity low
- `meesho.io` (URL): in scope, bounty-eligible, max severity low
- `prod.meeshoapi.com` (API): in scope, bounty-eligible, max severity critical
- `superstoreapp.meesho.com` (URL): in scope, bounty-eligible, max severity high
- `supplier.meesho.com` (URL): in scope, bounty-eligible, max severity critical
- `www.meesho.com` (URL): in scope, bounty-eligible, max severity critical
- `www.valmo.in` (URL): in scope, bounty-eligible, max severity critical
- `*.meesho.com` (WILDCARD): out of scope, max severity none
- `*.meesho.io` (WILDCARD): out of scope, max severity none
- `*.meeshoaiservices.ai` (WILDCARD): out of scope, max severity none
- `*.meeshoapi.com` (WILDCARD): out of scope, max severity none
- `*.meeshogcp.in` (WILDCARD): out of scope, max severity none
- `*.meeshosupply.com` (WILDCARD): out of scope, max severity none
- `*.valmo.in` (WILDCARD): out of scope, max severity none
- `admin.meesho.io` (URL): out of scope, max severity none
- `affiliate-c.meesho.com` (URL): out of scope, max severity none
- `agency.meesho.com` (URL): out of scope, max severity none
- `atlas.valmo.in` (URL): out of scope, max severity none
- `console.valmo.in` (URL): out of scope, max severity none
- `di-prd-superset.meesho.com` (URL): out of scope, max severity none
- `farmiso.meeshosupply.com` (URL): out of scope, max severity none
- `grocery-supplier.meesho.com` (URL): out of scope, max severity none
- `log10-web-staging.valmo.in` (URL): out of scope, max severity none
- `Other Asset` (OTHER): out of scope, max severity none
- `Out of Scope` (OTHER): out of scope, max severity none
- `warehouse.meesho.com` (URL): out of scope, max severity none
- `1457958492` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.