Policy and restrictions
Use owned/authorized accounts, protect privacy and availability, and observe monetary limits. Social engineering and disruption are prohibited. Disclosure needs consent; safe harbor is conditional.
Eligibility and submission status
Employees and third-party providers are excluded. Bank-account access requires valid regional tax identification and approval; false identification is prohibited. Platform first-valid-report rules apply; monetary compensation requires age 18 or the applicable age of majority.
The official brief explicitly displays In progress and an ongoing period.
Advertised rewards
Ordinary tiers span USD 50–4,000, 50–2,000 and 50–1,000. June 2026 bonuses expired. A September 22–October 16, 2026 campaign offers approximately $100 extra from a dedicated pool, subject to eligibility and excluded from bounds.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
Nubank Android: Play StorePublished location: https://play.google.com/store/apps/details?id=com.nu.production&hl=pt_BR&gl=US&pli=1 | android | Core Assets |
Nubank iOS AppPublished location: https://apps.apple.com/br/app/nubank-conta-e-cart%C3%A3o/id814456780 | ios | Core Assets |
prod-*.nubank.com.br | api | Core Assets |
prod-*.nu.com.mx | api | Core Assets |
prod-*.nu.com.co | api | Core Assets |
*.nubank.com.brPublished location: https://nubank.com.br/ | other | Primary Assets |
*.nu.com.mxPublished location: https://nubank.com.mx | other | Primary Assets |
*.nu.com.coPublished location: https://nubank.com.co | other | Primary Assets |
*.nuinvest.com.brPublished location: https://www.nuinvest.com.br/ | website | Supplementary Assets |
| Asset | Type | Group / eligibility |
|---|---|---|
*.nuinternational.com | website | Out of Scope |
*.nat-a.nubank.com.br | other | Out of Scope |
international.nubank.com.br | website | Out of Scope |
NuCommunity endpoints (BR, MX, CO) | website | Out of Scope |
Review limitations
- Brief revision: June 26, 2026. Change index: page 1 of 3 only; diffs unreviewed.
- September bonus evidence comes from the full notice embedded in the brief; archive index reviewed.
- USD uses platform accounting evidence. Browser-only policy recovery; authenticated eligibility and incorporated terms incompletely reviewed. Inventories/instructions omitted; live terms prevail. No authorization granted.
Sources and provenance
- Nubank Brasil Managed Bug Bounty Program public brief Nubank Brasil / Bugcrowd · reviewed 2026-10-03
- Nubank Brasil Managed Bug Bounty Program announcement archive Nubank Brasil / Bugcrowd · reviewed 2026-10-03
- Nubank Brasil Managed Bug Bounty Program change index Nubank Brasil / Bugcrowd · reviewed 2026-10-03
- Bugcrowd Organization Accounting Bugcrowd · reviewed 2026-10-03
- Bugcrowd Standard Disclosure Terms Bugcrowd · reviewed 2026-10-03
- Published Bugcrowd scope groups Nubank Brasil · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot d5550c789111. Open the complete JSON contract.