PayPal Bug Bounty
PayPal, Venmo, Braintree, Honey. Auth, payments, and account linking. High bar, high duplicates.
Tags: vendor, bugcrowd, payments
- Program model
- Vendor on Bugcrowd
- Regions
- Global
- Payout
- USD via Bugcrowd; published ranges on the program brief
Specialties: payments, auth, web, mobile
How to approach it
Do not touch other customers' money. Two accounts you own, sandbox where offered.
- OAuth linking and session fixation around checkout have been the durable classes.
- Read the out-of-scope payment-fraud list twice.