What this record establishes
Reviewed policy
An individually reviewed public policy is linked to this program page.
Read the reviewed policy profile →
Official directory card labeled Bug Bounty. Monetary reward displayed. Program policy and submission status not reviewed.
Published asset scope
Snapshot captured 2026-10-03. Scope status: Captured.
| Asset | Type | Group / eligibility |
|---|---|---|
Nubank Android: Play StorePublished location: https://play.google.com/store/apps/details?id=com.nu.production&hl=pt_BR&gl=US&pli=1 | android | Core Assets |
Nubank iOS AppPublished location: https://apps.apple.com/br/app/nubank-conta-e-cart%C3%A3o/id814456780 | ios | Core Assets |
prod-*.nubank.com.br | api | Core Assets |
prod-*.nu.com.mx | api | Core Assets |
prod-*.nu.com.co | api | Core Assets |
*.nubank.com.brPublished location: https://nubank.com.br/ | other | Primary Assets |
*.nu.com.mxPublished location: https://nubank.com.mx | other | Primary Assets |
*.nu.com.coPublished location: https://nubank.com.co | other | Primary Assets |
*.nuinvest.com.brPublished location: https://www.nuinvest.com.br/ | website | Supplementary Assets |
| Asset | Type | Group / eligibility |
|---|---|---|
*.nuinternational.com | website | Out of Scope |
*.nat-a.nubank.com.br | other | Out of Scope |
international.nubank.com.br | website | Out of Scope |
NuCommunity endpoints (BR, MX, CO) | website | Out of Scope |
Capture limits
- Brief revision: June 26, 2026. Change index: page 1 of 3 only; diffs unreviewed.
- September bonus evidence comes from the full notice embedded in the brief; archive index reviewed.
- USD uses platform accounting evidence. Browser-only policy recovery; authenticated eligibility and incorporated terms incompletely reviewed. Inventories/instructions omitted; live terms prevail. No authorization granted.
- Published target group rows were captured; group descriptions, rules and exclusions may further narrow permitted research.
Live policy and platform eligibility still require review.
Sources and collection identity
- Official program page Primary source · reviewed 2026-10-03
- Published scope source Primary source · reviewed 2026-10-03
Appears in Discovery, Bounty, Bugcrowd, Profile. No identity match is inferred from a shared company name.