Policy and restrictions
Disclosure needs written consent. Automation is bounded; disruption, social engineering, physical intrusion and brute force are prohibited.
Eligibility and submission status
Researcher-identified platform accounts are required. Certain production access requires customer identity checks; credentials for the associated payment-service portfolio are unavailable. Platform eligibility requires age 18, or 16 with guardian permission, plus legal and employer authorization.
Logged-out policy and login invitation do not independently establish current intake status.
Advertised rewards
No monetary bounty schedule; currency and numeric bounds remain null.
Advertised schedules and exceptional ceilings are not individual award evidence.
Published scope snapshot
Captured 2026-10-03. Check the current policy for changes before participating.
| Asset | Type | Group / eligibility |
|---|---|---|
*.truelayer.com | Wildcard | Tier 1 |
*.zimpler.net | Wildcard | Tier 2 |
*.sandbox.zimpler.net | Wildcard | Tier 3 |
*.staging.zimpler.net | Wildcard | Tier 3 |
*.truelayer-sandbox.com | Wildcard | Tier 3 |
checkout-playground.zimpler.comPublished location: http://checkout-playground.zimpler.com | URL | Tier 3 |
devdocs.zimpler.comPublished location: http://devdocs.zimpler.com | URL | Tier 3 |
identify.zimpler.comPublished location: http://identify.zimpler.com | URL | Tier 3 |
okta-oauth2.zimpler.comPublished location: http://okta-oauth2.zimpler.com | URL | Tier 3 |
swish-playground.zimpler.comPublished location: http://swish-playground.zimpler.com | URL | Tier 3 |
zimpler-merchant.zimpler.comPublished location: http://zimpler-merchant.zimpler.com | URL | Tier 3 |
| Asset | Type | Group / eligibility |
|---|---|---|
*.zimpler.com | Wildcard |
Review limitations
- The separate paid program does not change this VDP’s explicit no-reward policy.
- Anonymous-reporting language coexists with platform-account requirements; anonymous intake was not verified.
- No revision archive, expanded safe-harbor text or complete incorporated-document review was established.
- Logged-out review; summaries omit inventories and procedures. Live terms prevail; this record grants no authorization.
Sources and provenance
- TrueLayer Vulnerability Disclosure Program policy TrueLayer / Intigriti · reviewed 2026-10-03
- Intigriti Researcher Terms & Conditions Intigriti · reviewed 2026-10-03
- Published Intigriti asset table TrueLayer · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot d5550c789111. Open the complete JSON contract.