In brief. Visa is a bug bounty program on HackerOne. It received 146 reports in the 90 days to November 7, 2026, about 0.7 per in-scope asset. As of Nov 7, 2026. Markdown for agents

NR Unrated

Visa

Visa HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at Visa? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 7 Nov 2026.

What it pays, by severity

Critical amount not published 3 reports

High amount not published 10 reports

Medium $750 avg 66 reports firm

Low $250 avg 40 reports firm

$91,150 paid to researchers in total, $18,750 of it in the last 90 days. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received

146

in 90 days

Resolved

120

all time, last one yesterday

Participants

hunters engaged

Response efficiency

76%

meeting its targets, HackerOne’s figure

SLA misses

targets missed

Reports received, day by day, last 29 days 146–185

9 Oct 146 reports 7 Nov

Response targets it sets itself

First response

1 day

Triage

2 days

Bounty

30 days

Resolution

30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

Open to submit. HackerOne lists no requirements for submitting a report here.

Over 77 days (53 snapshots): intake down 57 reports; 90-day payout up $11,750.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

76 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	j0thezer0	713	20 / 26 77%
2	a_saqr	450	24 / 96 25%
2	a1_saqr	450	24 / 96 25%
3	ahmed_eldoc	391	20 / 48 42%
4	akashhamal0x01	174	8 / 19 42%
5	vaness120	152	6 / 25 24%
6	rektile404	114	2 / 3 67%
7	shoponalom29	110	5 / 5 100%
7	m0kr4n3	57	1 / 2 50%
7	mappymappy123	57	1 / 1 100%
8	nhuchau103	91	4 / 7 57%
8	viridian_40826d	54	2 / 2 100%
9	shubh_hackss	54	2 / 4 50%
10	inzo_	48	3 / 4 75%
11	theo0k	44	2 / 3 67%
11	yoyomiski	44	2 / 13 15%
12	n0_0b	32	1 / 1 100%
13	mohdsafwan_1	34	2 / 2 100%
14	hanmabaki	34	2 / 6 33%
14	amalyoman	32	1 / 5 20%
14	b3rnie52	32	1 / 6 17%
14	rizwansiddiqu1	32	1 / 2 50%
16	n4s1rl1	22	1 / 6 17%
17	abd	22	1 / 1 100%
17	am_95	22	1 / 1 100%

Showing the top 25 of 76 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 6 Nov 2026.

We are a global payments technology company working to enable consumers, businesses, banks and governments to use digital currency.

Responsiveness

76% HackerOne’s figure

Swag

Currency

USD

Submissions

Open

Launched

Jul 2023

Scope entries

218 HackerOne’s count

Scope

215 assets

Asset	Type	Eligibility	Max severity
*.prod.innovexperiments.com	OTHER	✓ bounty	Critical
*.visamiddleeast.com	WILDCARD	✓ bounty	Critical
admin-portal.api-xperience.com	URL	✓ bounty	Critical
africa.visa.com	URL	✓ bounty	Critical
api.prod.innovexperiments.com	URL	✓ bounty	Critical

Show all 215 assets

Asset	Type	Eligibility	Max severity
askpeopleteam.visa.com	URL	✓ bounty	Critical
aw.visa.com	URL	✓ bounty	Critical
bb.visa.com	URL	✓ bounty	Critical
bd.visa.com	URL	✓ bounty	Critical
bm.visa.com	URL	✓ bounty	Critical
bq.visa.com	URL	✓ bounty	Critical
by.visa.com	URL	✓ bounty	Critical
capability.prod.innovexperiments.com	URL	✓ bounty	Critical
cis.visa.com	URL	✓ bounty	Critical
codeofconduct.visa.com	URL	✓ bounty	Medium
console.tink.com	URL	✓ bounty	Critical
cw.visa.com	URL	✓ bounty	Critical
cybersourcebouncebacks.visa.com	URL	✓ bounty	Medium
developer.authorize.net	URL	✓ bounty	Critical
developer.currencycloud.com	URL	✓ bounty	High
developer.cybersource.com	URL	✓ bounty	Critical
developer.plus.authorize.net	URL	✓ bounty	Critical
developer.visa.com	URL	✓ bounty	Critical
developers.pismo.io	URL	✓ bounty	Medium
direct-demo.currencycloud.com	URL	✓ bounty	Critical
dwy.visa.com	URL	✓ bounty	Critical
ebctest.cybersource.com	URL	✓ bounty	Critical
experience.prod.innovexperiments.com	URL	✓ bounty	Critical
forms.cybersource.com	OTHER	✓ bounty	Medium
garp.visa.com	URL	✓ bounty	Critical
ht.visa.com	URL	✓ bounty	Critical
http://ebctest.cybersource.com/listmanager	URL	✓ bounty	Critical
http://myvisainfinite.com/suntrust/en_us/home.html	URL	✓ bounty	Critical
http://test.payworks.io/uis/mngr/	URL	✓ bounty	Critical
http://www.myvisacardportal.com/welcome/enbd/product/#	URL	✓ bounty	Critical
https://ebc2test.cybersource.com/settings	URL	✓ bounty	Critical
https://ebctest.cybersource.com/bin	URL	✓ bounty	Critical
https://ebctest.cybersource.com/boarding/v1/registrations	URL	✓ bounty	Critical
https://ebctest.cybersource.com/boarding/v1/templates	URL	✓ bounty	Critical
https://ebctest.cybersource.com/bos	URL	✓ bounty	Critical
https://ebctest.cybersource.com/casemanagement	URL	✓ bounty	Critical
https://ebctest.cybersource.com/cds/	URL	✓ bounty	Critical
https://ebctest.cybersource.com/CGK2	URL	✓ bounty	Critical
https://ebctest.cybersource.com/dmconfigapi	URL	✓ bounty	Critical
https://ebctest.cybersource.com/epcapi	URL	✓ bounty	Critical
https://ebctest.cybersource.com/identity	URL	✓ bounty	Critical
https://ebctest.cybersource.com/invoicing	URL	✓ bounty	Critical
https://ebctest.cybersource.com/jobs	URL	✓ bounty	Critical
https://ebctest.cybersource.com/kms/	URL	✓ bounty	Critical
https://ebctest.cybersource.com/listmanager	URL	✓ bounty	Critical
https://ebctest.cybersource.com/merchant-mgmt/	URL	✓ bounty	Critical
https://ebctest.cybersource.com/merchantvelocity	URL	✓ bounty	Critical
https://ebctest.cybersource.com/mms	URL	✓ bounty	Critical
https://ebctest.cybersource.com/notification-subscriptions	URL	✓ bounty	Critical
https://ebctest.cybersource.com/oms	URL	✓ bounty	Critical
https://ebctest.cybersource.com/partner	URL	✓ bounty	Critical
https://ebctest.cybersource.com/payerauthentication	URL	✓ bounty	Critical
https://ebctest.cybersource.com/payment	URL	✓ bounty	Critical
https://ebctest.cybersource.com/pbl	URL	✓ bounty	Critical
https://ebctest.cybersource.com/prcs	URL	✓ bounty	Critical
https://ebctest.cybersource.com/prefs	URL	✓ bounty	Critical
https://ebctest.cybersource.com/processorconfigapi	URL	✓ bounty	Critical
https://ebctest.cybersource.com/products/virtual-terminal	URL	✓ bounty	Critical
https://ebctest.cybersource.com/pts/v1/transaction-batch-upload	URL	✓ bounty	Critical
https://ebctest.cybersource.com/pts/v2	URL	✓ bounty	Critical
https://ebctest.cybersource.com/reporting	URL	✓ bounty	Critical
https://ebctest.cybersource.com/riskui	URL	✓ bounty	Critical
https://ebctest.cybersource.com/saconfig	URL	✓ bounty	Critical
https://ebctest.cybersource.com/sms	URL	✓ bounty	Critical
https://ebctest.cybersource.com/tech-partner-integration	URL	✓ bounty	Critical
https://ebctest.cybersource.com/tms	URL	✓ bounty	Critical
https://ebctest.cybersource.com/tss	URL	✓ bounty	Critical
https://ebctest.cybersource.com/ums	URL	✓ bounty	Critical
https://ebctest.cybersource.com/underwriting	URL	✓ bounty	Critical
https://ebctest.cybersource.com/varm	URL	✓ bounty	Critical
https://ebctest.cybersource.com/vdm	URL	✓ bounty	Critical
https://ebctest.cybersource.com/vroom	URL	✓ bounty	Critical
https://ebctest.cybersource.com/vts	URL	✓ bounty	Critical
https://solutions.visaacceptance.com/subscription	URL	✓ bounty	Medium
https://usa.visa.com/gateway/api	URL	✓ bounty	Critical
https://www.currencycloud.com/	URL	✓ bounty	Critical
https://www.myvisacardportal.com/enbd/en_ae/landing/	URL	✓ bounty	Critical
https://www.visa.com.az/az_az/account/registration	URL	✓ bounty	Critical
https://www.visa.com.ua/	URL	✓ bounty	Critical
infinite.visa.fr	URL	✓ bounty	Critical
info.cybersource.com	URL	✓ bounty	Medium
kino.visa.pl	URL	✓ bounty	Critical
merchantsignageap.visa.com	URL	✓ bounty	Medium
merchantsignagejp.visa.com	URL	✓ bounty	Medium
my.visa.fr	URL	✓ bounty	Critical
myanmar.visa.com	URL	✓ bounty	Critical
myvu.visauniversity.com	URL	✓ bounty	Medium
releasor.payworks.com/	URL	✓ bounty	Critical
rs.visa.com	URL	✓ bounty	Critical
sandbox.authorize.net	URL	✓ bounty	Critical
sandbox.developer.plus.authorize.net	URL	✓ bounty	Critical
sandbox.secure.checkout.visa.com	URL	✓ bounty	Critical
sap.api-xperience.com	URL	✓ bounty	Critical
sr.visa.com	URL	✓ bounty	Critical
survey.visa.com	URL	✓ bounty	Critical
test.payworks.io	URL	✓ bounty	Critical
testbank.xs2a.com	URL	✓ bounty	Critical
usa.visa.com	URL	✓ bounty	Critical
vasdemos.visa.com	URL	✓ bounty	Critical
vdam.visa.com	URL	✓ bounty	Critical
vgov.catalogue.digitalcontrolroom.com	URL	✓ bounty	Medium
visa.co.cr	URL	✓ bounty	Critical
visa.co.ni	URL	✓ bounty	Critical
visa.co.za	URL	✓ bounty	Critical
visa.com.au	URL	✓ bounty	Critical
visa.com.bo	URL	✓ bounty	Critical
visa.com.jm	URL	✓ bounty	Critical
visa.com.mx	URL	✓ bounty	Critical
visa.com.ru	URL	✓ bounty	Critical
visa.com.ua	URL	✓ bounty	Critical
visa.in	URL	✓ bounty	Critical
visainnovationprogram.com	URL	✓ bounty	Medium
visaonchainanalytics.com	URL	✓ bounty	Medium
visasgic.api-xperience.com	URL	✓ bounty	Critical
vucs.visa.com	URL	✓ bounty	Critical
vwcm.visa.com	URL	✓ bounty	Critical
www.authorize.net	URL	✓ bounty	Critical
www.cardinalcommerce.com	URL	✓ bounty	Critical
www.currencycloud.com	URL	✓ bounty	Critical
www.cybersource.com	URL	✓ bounty	Critical
www.fraedom.com	URL	✓ bounty	High
www.mz.visa.com	URL	✓ bounty	Critical
www.practicalbusinessskills.org	URL	✓ bounty	Critical
www.practicalmoneyskills.com	URL	✓ bounty	Critical
www.practicalmoneyskills.org	URL	✓ bounty	Critical
www.tink.com	URL	✓ bounty	Critical
www.trialpay.com	URL	✓ bounty	Critical
www.visa.be	URL	✓ bounty	Critical
www.visa.ca	URL	✓ bounty	Critical
www.visa.cl	URL	✓ bounty	Critical
www.visa.cn	URL	✓ bounty	Critical
www.visa.co.ao	URL	✓ bounty	Critical
www.visa.co.cr	URL	✓ bounty	Critical
www.visa.co.id	URL	✓ bounty	Critical
www.visa.co.il	URL	✓ bounty	Critical
www.visa.co.in	URL	✓ bounty	Critical
www.visa.co.jp	URL	✓ bounty	Critical
www.visa.co.ke	URL	✓ bounty	Critical
www.visa.co.ni	URL	✓ bounty	Critical
www.visa.co.nz	URL	✓ bounty	Critical
www.visa.co.th	URL	✓ bounty	Critical
www.visa.co.uk	URL	✓ bounty	Critical
www.visa.co.ve	URL	✓ bounty	Critical
www.visa.com	URL	✓ bounty	Critical
www.visa.com.az	URL	✓ bounty	Critical
www.visa.com.bo	URL	✓ bounty	Critical
www.visa.com.br	URL	✓ bounty	Critical
www.visa.com.cn	URL	✓ bounty	Critical
www.visa.com.cy	URL	✓ bounty	Critical
www.visa.com.ge	URL	✓ bounty	Critical
www.visa.com.hk	URL	✓ bounty	Critical
www.visa.com.hn	URL	✓ bounty	Critical
www.visa.com.hr	URL	✓ bounty	Critical
www.visa.com.jm	URL	✓ bounty	Critical
www.visa.com.kh	URL	✓ bounty	Critical
www.visa.com.kz	URL	✓ bounty	Critical
www.visa.com.lc	URL	✓ bounty	Critical
www.visa.com.lk	URL	✓ bounty	Critical
www.visa.com.ms	URL	✓ bounty	Critical
www.visa.com.mx	URL	✓ bounty	Critical
www.visa.com.my	URL	✓ bounty	Critical
www.visa.com.ng	URL	✓ bounty	Critical
www.visa.com.ph	URL	✓ bounty	Critical
www.visa.com.ru	URL	✓ bounty	Critical
www.visa.com.sg	URL	✓ bounty	Critical
www.visa.com.tr	URL	✓ bounty	Critical
www.visa.com.tw	URL	✓ bounty	Critical
www.visa.com.ua	URL	✓ bounty	Critical
www.visa.com.vn	URL	✓ bounty	Critical
www.visa.cz	URL	✓ bounty	Critical
www.visa.de	URL	✓ bounty	Critical
www.visa.dk	URL	✓ bounty	Critical
www.visa.dm	URL	✓ bounty	Critical
www.visa.ee	URL	✓ bounty	Critical
www.visa.es	URL	✓ bounty	Critical
www.visa.fi	URL	✓ bounty	Critical
www.visa.fr	URL	✓ bounty	Medium
www.visa.gr	URL	✓ bounty	Critical
www.visa.hu	URL	✓ bounty	Critical
www.visa.ie	URL	✓ bounty	Critical
www.visa.is	URL	✓ bounty	Critical
www.visa.lt	URL	✓ bounty	Critical
www.visa.lv	URL	✓ bounty	Critical
www.visa.mn	URL	✓ bounty	Critical
www.visa.nl	URL	✓ bounty	Critical
www.visa.no	URL	✓ bounty	Critical
www.visa.pl	URL	✓ bounty	Critical
www.visa.pt	URL	✓ bounty	Critical
www.visa.ro	URL	✓ bounty	Critical
www.visa.se	URL	✓ bounty	Critical
www.visa.sk	URL	✓ bounty	Critical
www.visabg.com	URL	✓ bounty	Critical
www.visaeurope.at	URL	✓ bounty	Critical
www.visaeurope.ch	URL	✓ bounty	Critical
www.visaeurope.es	URL	✓ bounty	Medium
www.visaeurope.lu	URL	✓ bounty	Critical
www.visaeurope.si	URL	✓ bounty	Critical
www.visainfinite.ca	URL	✓ bounty	Critical
www.visaitalia.com	URL	✓ bounty	Critical
www.visakorea.com	URL	✓ bounty	Critical
www.visamiddleeast.com	URL	✓ bounty	Critical
www.visasoutheasteurope.com	URL	✓ bounty	Critical
www.yellowpepper.com	URL	✓ bounty	Critical
app.demand.cybersource.com	URL	out	None
images.demand.cybersource.com	URL	out	None
info.authorize.net	URL	out	None
merchantsignage.visa.com	URL	out	None
merchantsignageca.visa.com	URL	out	None
merchantsignageeu.visa.com	URL	out	None
merchantsignageglobal.visa.com	URL	out	None

HackerOne lists 218 scope entries. Its public listing groups many assets under one label, so we show identical entries once.