# XP Inc Vulnerability Disclosure: vulnerability disclosure program on HackerOne

> XP Inc Vulnerability Disclosure is a vulnerability disclosure program on HackerOne. It does not pay bounties. It received 73 reports in the 90 days to October 27, 2026, about 4.9 per in-scope asset.

- **Company:** XP Inc Vulnerability Disclosure
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/xp_inc_vdp
- **Pays bounties:** no
- **Submissions:** open
- **Launched:** October 27, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/xp-inc-vdp

## Payouts and volume

HackerOne's own published figures, captured October 27, 2026.

- Reports received in the last 90 days: 73 (about 4.9 per in-scope asset)
- Researchers participating: 4
- Response efficiency: 97%
- First-response target: 5 days
- Triage target: 10 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on October 27, 2026: 15 assets in scope (0 bounty-eligible), 0 out of scope. The policy page is the authority.

- `clear.com.br` (URL): in scope, no bounty, max severity critical
- `expertxp.com.br` (URL): in scope, no bounty, max severity medium
- `https://apps.apple.com/br/app/clear/id6447694643` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `https://apps.apple.com/br/app/xp-empresas-conta-pj/id1566254578` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `https://apps.apple.com/br/app/xp-investimentos/id1300713021` (APPLE_STORE_APP_ID): in scope, no bounty, max severity critical
- `https://play.google.com/store/apps/details?id=br.com.xp.carteira` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `https://play.google.com/store/apps/details?id=br.com.xpinc.clear.app.android` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `https://play.google.com/store/apps/details?id=br.com.xpinc.xpempresas` (GOOGLE_PLAY_APP_ID): in scope, no bounty, max severity critical
- `infomoney.com.br` (URL): in scope, no bounty, max severity high
- `modalmais.com.br` (URL): in scope, no bounty, max severity critical
- `rico.com.vc` (URL): in scope, no bounty, max severity critical
- `sociedadedogain.com.br` (URL): in scope, no bounty, max severity medium
- `xpeducacao.com.br` (URL): in scope, no bounty, max severity critical
- `xpempresas.com.br` (URL): in scope, no bounty, max severity critical
- `xpi.com.br` (URL): in scope, no bounty, max severity critical

---

Generated October 27, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.