
PayPal
External Program
Submit bugs directly to this organization
###Our team of dedicated security professionals works diligently to maintain the security of customer information. We acknowledge the crucial role that security researchers and our user community play in helping to keep PayPal and our customers secure. If you identify a vulnerability in our site or products, please notify us using the guidelines outlined below.
As a researcher, we understand your eagerness to start testing immediately. However, we strongly recommend that you read the full program terms. We also follow the HackerOne platform standards. Here is a brief overview:
We at PayPal define impact as the potential consequences of a vulnerability on our systems, operations, and users. This includes factors such as financial losses, data breaches, operational disruptions, reputational damage, and regulatory or legal consequences. By assessing the impact of a vulnerability, we can prioritize our response and remediation efforts and ensure the security and integrity of our platform, while protecting our users' sensitive information and maintaining their trust in our services.
Please note that your participation in the Bug Bounty Program is voluntary and subject to the terms and conditions set forth on this page ("Program Terms"). By submitting a site or product vulnerability to PayPal, Inc. ("PayPal") you acknowledge that you have read and agreed to these Program Terms.
These Program Terms supplement the terms of PayPal User Agreement, the PayPal Acceptable Use Policy, and any other agreement in which you have entered with PayPal (collectively "PayPal Agreements"). The terms of those PayPal Agreements will apply to your use of, and participation in, the Bug Bounty Program as if fully set forth herein. If any inconsistency exists between the terms of the PayPal Agreements and these Program Terms, these Program Terms will control, but only regarding the Bug Bounty Program.
To encourage responsible disclosures, PayPal commits that, if we conclude, in our sole discretion, that a disclosure respects and meets all the guidelines of these Program Terms and the PayPal Agreements, PayPal will not bring a private action against you or refer a matter for public inquiry.
As part of your research, do not modify any files or data, including permissions, and do not intentionally view or access any data beyond what is needed to prove the vulnerability.
##The following PayPal brands are in scope:
For questions or issues specific to accounts or transactions, or other requests that do not fall under this scope, please contact our customer support service.
###Brands and acquisitions not listed above are not in scope. These brands include, but are not limited to the following:
PayPal will make a best effort to adhere to the following response targets:
| Type of Response | Business days | Reason |
|---|---|---|
| First Response | 2 days | |
| Time to Triage | 10+ days | Depends on report clarity and complexity |
| Time to Bounty | 15 - 30 days | Depends on report clarity, complexity and demonstrated Impact |
| Time to Resolution | depends on severity and complexity |
To be eligible for the Bug Bounty Program, you must not:
If PayPal discovers that you meet any of the criteria above, PayPal will remove you from the Bug Bounty Program and disqualify you from receiving any Bounty Payments.
By providing a Submission or agreeing to the Program Terms, You agree that you may not publicly disclose your findings or the contents of your Submission to any third parties in any way without PayPal’s prior written approval.
Failure to comply with the Program Terms will result in immediate disqualification from the Bug Bounty Program and ineligibility for receiving any Bounty Payments.
Accepted in-scope vulnerabilities include, but are not limited to:
Certain vulnerabilities are considered out-of-scope for the Bug Bounty Program. Those out-of-scope vulnerabilities include, but are not limited to:
##Denial of Service In our commitment to maintaining a secure environment, we value your assistance in identifying Denial of Service (DoS) vulnerabilities that meet our specific criteria. Generally:
To ensure the stability and security of our systems while allowing responsible security research, we have established the following policy regarding Denial-of-Service (DoS) testing:
Sandbox-Only DoS Testing
Theoretical Reports for Production
If you neglect the DoS policy and test on production and cause an availability Issue:
###DoS Testing Guidelines:
If you think you have found an eligible DoS issue, please include the following information in your report:
In addition to in-scope items mentioned above, some additional vulnerability types will be considered in-scope for mobile applications. These include:
The following mobile vulnerabilities are out-of-scope and will not be accepted:
**When testing PayPal assets: **
<username>[email protected] address where applicable.X-PP-BB: HackerOne-<username>
- Example: X-PP-BB: HackerOne-gonpp cat /proc/1/maps
- Write: touch /root/<your H1 username>
- Execute: id, hostname, pwd
- ***Check the full RCE guidelines below. *****For all submissions, please include: **
Failure to include any of the above items may delay or jeopardize the Bounty Payment
***Once your report is closed, securely delete any inadvertently accessed data. ***
##Remote Code Execution (RCE) Submission Guidelines: Failure to meet the below conditions and requirements could result in a forfeiture of any potential Bounty Payment.
##PayPal Merchants/ third-party integrations: Researchers are requested to submit any findings involving merchants’ PayPal integrations (for example, when a merchant uses PayPal as an option in their payment system) directly to PayPal’s bug bounty program before reporting them to the merchant, so PayPal can confirm whether the issue originates from its systems or from the merchant’s integration and help coordinate with the merchant.
PayPal's vulnerability reward program does not solely rely on CVSS scores for determining compensation. While CVSS scores are considered during initial submission assessment, final rewards are based on PayPal’s internal evaluation of the vulnerability's demonstrated impact. PayPal reserves the right to make final bounty decisions based on this assessment, as high CVSS scores do not always correlate with high impact.
You may be eligible to receive a monetary reward (“Bounty Payment”) if:
- (i) you are the first person to submit a site or product vulnerability.
- (ii) that vulnerability is determined to by a valid security issue by PayPal’s security team; and
- (iii) you have complied with all Program Terms and platform standards. Bounty Payments, if any, will be determined by PayPal, in PayPal’s sole discretion. In no event shall PayPal be obligated to pay you a bounty for any Submission. All Bounty Payments shall be considered gratuitous.
All Bounty Payments will be made in United States dollars (USD). You will be responsible for any tax implications related to Bounty Payments you receive, as determined by the laws of your jurisdiction of residence or citizenship.
PayPal will determine all Bounty Payments based on the risk and impact of the vulnerability. The minimum bounty amount for a validated bug submission is $50 USD and the maximum bounty for a validated bug submission is $30,000 USD.
PayPal Bug Bounty Team retains the right to determine if the bug submitted to the Bug Bounty Program is eligible. All determinations as to the amount of a bounty made by the PayPal Bug Bounty Team are final. Bounty Payment ranges are based on the classification and sensitivity of the data impacted, ease of exploit and overall risk to PayPal customers, PayPal brand and determined to be a valid security issue by PayPal’s security engineers.
| Severity | Description | Reward Range |
|---|---|---|
| Critical | Exploits that can lead to significant data breach, system compromise, significant data leak, or severe operational disruption. | $20,000 – $30,000 |
| High | Vulnerabilities that can cause considerable harm, such as data leaks or unauthorized access to sensitive areas. | $10,000 – $20,000 |
| Medium | Issues that can lead to limited unauthorized access or data exposure. | $1,000 – $10,000 |
| Low | Minor vulnerabilities with limited impact and no immediate security risk. | $50 – $1000 |
###The following bugs will have a set bounty payout:
| Bugs | Low (0.1 - 3.9) | Medium (4.0 - 6.9) | High (7.0 - 8.9) | Critical (9.0 - 10.0) |
|---|---|---|---|---|
| Subdomain Takeover | $200 | $200 | $3,000 | $5,000 |
| XSS | $50 - $500 | $500 - $3000 | $3,000 - $6,000 | $6,000 |
###Valid reports on the following will receive different percentages of the standard bounty:
www.paypal-*.com will receive 10% of the standard bounty##Zero Day Submissions: For zero-day vulnerabilities reported through our bug bounty program, PayPal applies the following payout structure:
| Submission Timeframe | Payout Percentage |
|---|---|
| Within the first 5 days of discovery | No payout |
| Within 6-30 days of discovery | 25% of standard bounty |
| Within 31-60 days of discovery | 50% of standard bounty |
| After 60 days of discovery | Full standard bounty |
Please note that the timeline for any zero-day submission begins from the first known instance of active exploitation of the zero-day vulnerability.
As a condition of participation in the PayPal Bug Bounty Program, you hereby grant PayPal, its subsidiaries, affiliates and customers a perpetual, irrevocable, worldwide, royalty-free, transferrable, sublicensable (through multiple tiers) and non-exclusive license to use, reproduce, adapt, modify, publish, distribute, publicly perform, create derivative work from, make, use, sell, offer for sale and import the Submission, as well as any materials submitted to PayPal in connection therewith, for any purpose. You should not send us any Submission that you do not wish to license to us. You hereby represent and warrant that the Submission is original to you and you own all right, title and interest in and to the Submission. Further, you hereby waive all other claims of any nature, including express contract, implied-in-fact contract, or quasi-contract, arising out of any disclosure of the Submission to PayPal. In no event shall PayPal be precluded from discussing, reviewing, developing for itself, having developed, or developing for third parties, materials which are competitive with those set forth in the Submission irrespective of their similarity to the information in the Submission, so long as PayPal complies with the terms of participation stated herein.
In the event (i) you breach any of these Program Terms or the terms and conditions of the PayPal Agreements; or (ii) PayPal determines, in its sole discretion that your continued participation in the Bug Bounty Program could adversely impact PayPal (including, but not limited to, presenting any threat to PayPal’s systems, security, finances and/or reputation) PayPal may immediately terminate your participation in the Bug Bounty Program and disqualify you from receiving any Bounty Payments. Please see our recommendations on the proper procedures for testing our applications.
Any information you receive or collect about PayPal or any PayPal user through the Bug Bounty Program (“Confidential Information”) must be kept confidential and only used in connection with the Bug Bounty Program. You may not use, disclose or distribute any such Confidential Information, including, but not limited to, any information regarding your Submission and information you obtain when researching the PayPal sites, without PayPal’s prior written consent.
In addition to any indemnification obligations you may have under the PayPal Agreements, you agree to defend, indemnify and hold PayPal, its subsidiaries, affiliates and the officers, directors, agents, joint ventures, employees and suppliers of PayPal, its subsidiaries, or our affiliates, harmless from any claim or demand (including attorneys’ fees) made or incurred by any third party due to or arising out of your Submissions, your breach of these Program Terms and/or your improper use of the Bug Bounty Program.
The Bug Bounty Program, including its policies, is subject to change or cancellation by PayPal at any time, without notice. As such, PayPal may amend these Program Terms and/or its policies at any time by posting a revised version on our website. By continuing to participate in the Bug Bounty Program after PayPal posts any such changes, you accept the Program Terms, as modified.