# Wolt: bug bounty program on HackerOne

> Wolt is a bug bounty program on HackerOne. It received 970 reports in the 90 days to November 6, 2026, about 75 per in-scope asset.

- **Company:** Wolt
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/wolt
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** July 27, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/wolt

## Payouts and volume

HackerOne's own published figures, captured November 6, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| High | $1,083 | 1 |
| Medium | $825 | not published |
| Low | $135 | not published |

- Reports received in the last 90 days: 970 (about 75 per in-scope asset)
- Bounties paid in the last 90 days: $10,000
- Bounties paid in total: $10,000
- Researchers participating: 14
- Response efficiency: 91%
- First-response target: 5 days
- Triage target: 10 days
- Bounty target: 30 days
- Barriers: bounty amounts hidden

## Scope

As imported from HackerOne on November 6, 2026: 13 assets in scope (13 bounty-eligible), 12 out of scope. The policy page is the authority.

- `*.wolt.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `6GE6LAAR8V.com.woltapp.wolt` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `authentication.wolt.com` (URL): in scope, bounty-eligible, max severity critical
- `com.wolt.android` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `com.wolt.courierapp` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `corporate.wolt.com` (URL): in scope, bounty-eligible, max severity critical
- `drive.wolt.com` (URL): in scope, bounty-eligible, max severity critical
- `merchant.wolt.com` (URL): in scope, bounty-eligible, max severity critical
- `ops.wolt.com` (URL): in scope, bounty-eligible, max severity critical
- `restaurant-api.wolt.com` (URL): in scope, bounty-eligible, max severity critical
- `wolt.com` (URL): in scope, bounty-eligible, max severity critical
- `*.pipedrive.com` (WILDCARD): out of scope, max severity none
- `blog.wolt.com` (URL): out of scope, max severity none
- `gettest.wolt.com` (URL): out of scope, max severity none
- `https://merchant-onboarding-service.wolt.com/merchant-admin/inbound-merchant` (URL): out of scope, max severity none
- `https://merchant.wolt.com/api/merchant-onboarding/merchant-admin/inbound-merchant` (URL): out of scope, max severity none
- `https://merchant.wolt.com/app/partner-with-wolt` (URL): out of scope, max severity none
- `https://restaurant-api.wolt.com/v1/waw-api/corporate-leads` (URL): out of scope, max severity none
- `https://wolt.com/en/wolt-for-work-contact-request` (URL): out of scope, max severity none
- `https://wolt.typeform.com` (URL): out of scope, max severity none
- `links.wolt.com` (URL): out of scope, max severity none
- `press.wolt.com` (URL): out of scope, max severity none
- `wolt.atlassian.net` (URL): out of scope, max severity none
- `1477299281` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `943905271` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.