# Visa: bug bounty program on HackerOne

> Visa is a bug bounty program on HackerOne. It received 146 reports in the 90 days to November 7, 2026, about 0.7 per in-scope asset.

- **Company:** Visa
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/visa
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** July 10, 2023
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/visa

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | not published | 3 |
| High | not published | 10 |
| Medium | $750 | 66 |
| Low | $250 | 40 |

- Reports received in the last 90 days: 146 (about 0.7 per in-scope asset)
- Bounties paid in the last 90 days: $18,750
- Bounties paid in total: $91,150
- Researchers participating: 66
- Response efficiency: 76%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 208 assets in scope (208 bounty-eligible), 7 out of scope. The policy page is the authority.

- `*.prod.innovexperiments.com` (OTHER): in scope, bounty-eligible, max severity critical
- `*.visamiddleeast.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `admin-portal.api-xperience.com` (URL): in scope, bounty-eligible, max severity critical
- `africa.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `api.prod.innovexperiments.com` (URL): in scope, bounty-eligible, max severity critical
- `askpeopleteam.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `aw.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `bb.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `bd.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `bm.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `bq.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `by.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `capability.prod.innovexperiments.com` (URL): in scope, bounty-eligible, max severity critical
- `cis.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `codeofconduct.visa.com` (URL): in scope, bounty-eligible, max severity medium
- `console.tink.com` (URL): in scope, bounty-eligible, max severity critical
- `cw.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `cybersourcebouncebacks.visa.com` (URL): in scope, bounty-eligible, max severity medium
- `developer.authorize.net` (URL): in scope, bounty-eligible, max severity critical
- `developer.currencycloud.com` (URL): in scope, bounty-eligible, max severity high
- `developer.cybersource.com` (URL): in scope, bounty-eligible, max severity critical
- `developer.plus.authorize.net` (URL): in scope, bounty-eligible, max severity critical
- `developer.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `developers.pismo.io` (URL): in scope, bounty-eligible, max severity medium
- `direct-demo.currencycloud.com` (URL): in scope, bounty-eligible, max severity critical
- `dwy.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `ebctest.cybersource.com` (URL): in scope, bounty-eligible, max severity critical
- `experience.prod.innovexperiments.com` (URL): in scope, bounty-eligible, max severity critical
- `forms.cybersource.com` (OTHER): in scope, bounty-eligible, max severity medium
- `garp.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `ht.visa.com` (URL): in scope, bounty-eligible, max severity critical
- `http://ebctest.cybersource.com/listmanager` (URL): in scope, bounty-eligible, max severity critical
- `http://myvisainfinite.com/suntrust/en_us/home.html` (URL): in scope, bounty-eligible, max severity critical
- `http://test.payworks.io/uis/mngr/` (URL): in scope, bounty-eligible, max severity critical
- `http://www.myvisacardportal.com/welcome/enbd/product/#` (URL): in scope, bounty-eligible, max severity critical
- `https://ebc2test.cybersource.com/settings` (URL): in scope, bounty-eligible, max severity critical
- `https://ebctest.cybersource.com/bin` (URL): in scope, bounty-eligible, max severity critical
- `https://ebctest.cybersource.com/boarding/v1/registrations` (URL): in scope, bounty-eligible, max severity critical
- `https://ebctest.cybersource.com/boarding/v1/templates` (URL): in scope, bounty-eligible, max severity critical
- `https://ebctest.cybersource.com/bos` (URL): in scope, bounty-eligible, max severity critical
- and 175 more on the BugRater page

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.