Policy and restrictions
Scope is limited to selected mobile functionality; web applications and embedded web content are excluded. Automated scanners, bulk account creation, disruptive requests, social engineering and third-party application activity are prohibited. Minimize personal-data access. Written permission is required before disclosure.
Eligibility and submission status
The public brief requires reproducible, consequential findings, researcher-identified accounts and a signed NDA as a participation condition. Only owned or expressly authorized accounts may be involved. Platform first-valid-report rules apply; monetary compensation requires age 18 or the applicable age of majority.
The official brief explicitly displays In progress and an ongoing period, with a submission link. Individual eligibility remains subject to live terms.
Advertised rewards
Ordinary advertised bands are P4 $100–$250, P3 $250–$750, P2 $1,000–$2,000 and P1 $2,000–$3,500. A still-visible doubled schedule reaches $7,000, but the reviewed notice dates that campaign to July 7–22, 2025; it is excluded from normalized bounds. Awards remain discretionary.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
All In Scope Targets | other | Limited Double Bounty Promotion | July 7th - July 22nd |
Moovit Android AppPublished location: https://play.google.com/store/apps/details?id=com.tranzmate&hl=en_US | android | In Scope |
Moovit iOS AppPublished location: https://apps.apple.com/us/app/moovit-all-transit-options/id498477945 | ios | In Scope |
WayFinder - Augmented Reality helper to find your stopPublished location: https://support.moovitapp.com/hc/en-us/articles/11389054527122-WayFinder-Augmented-Reality-helper-to-find-your-stop-iPhone-only | ios | In Scope |
| Asset | Type | Group / eligibility |
|---|---|---|
Every Web App is Out Of Scope. | website | Out Of Scope |
Every app not related to the Moovit mobile application. | other | Out Of Scope |
Any WebView sources or web application rendered within the mobile applications | other | Out Of Scope |
Review limitations
- Brief and reviewed change index show February 12, 2026 as the latest revision; individual diffs were not opened.
- The announcement archive and July 7, 2025 promotion notice were opened. Its end date and stated duration are not perfectly aligned; no current bonus entitlement is inferred.
- NDA signing mechanics were not available in the reviewed brief and were not tested. Other archived announcement bodies were not separately opened.
- USD normalization uses platform accounting documentation; the brief itself uses dollar signs. No individual award or payment is established.
- Public policy pages only; authenticated submission and incorporated legal documents were not exhaustively reviewed. Asset inventories and testing instructions are omitted. Live terms prevail; this summary grants no authorization.
Sources and provenance
- Moovit Managed Bug Bounty Program public brief Moovit / Bugcrowd · reviewed 2026-10-03
- Moovit Managed Bug Bounty Program announcements Moovit / Bugcrowd · reviewed 2026-10-03
- Moovit Managed Bug Bounty Program change index Moovit / Bugcrowd · reviewed 2026-10-03
- Bugcrowd Organization Accounting Bugcrowd · reviewed 2026-10-03
- Bugcrowd Standard Disclosure Terms Bugcrowd · reviewed 2026-10-03
- Published Bugcrowd scope groups Moovit · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.