
Visa
External Program
Submit bugs directly to this organization
Visa is a global payments technology company that connects consumers, businesses, financial institutions and governments in more than 200 countries and territories to fast, secure and reliable digital currency.
We have established this Bug Bounty Program to facilitate our exchange of information about potential vulnerabilities, establish rules for vulnerability testing, and provide a safe harbor for individuals who follow these rules.
We look forward to working with the security community to find security vulnerabilities in order to keep our businesses and customers safe. Visa will make a best effort to respond to incoming reports within 2 business days and make a bounty determination after validating a legitimate security issue within 15 business days. We’ll try to keep you informed about our progress throughout the process.
To be eligible to receive rewards, you must:
You must also follow the HackerOne rules at all times and have cleared HackerOne’s sanctions screenings and other applicable procedures. Determinations as to whether a submission is eligible for a bounty and otherwise consistent with these rules are within Visa’s sole discretion.
If you believe you have discovered a potential security issue or other vulnerability, you must:
Determinations as to whether a submission is eligible for a bounty, the severity of the disclosed vulnerability, and whether a researcher’s conduct is consistent with these rules are within Visa’s sole discretion.
By accepting the invitation and participating in Visa's bug bounty program, you agree that you will:
Using or accessing accounts that belong to other users is absolutely prohibited. For testing applications that require authentication, you may only test using accounts you self-register. If self-registration is not possible, you may only conduct unauthenticated testing.
When creating test accounts, you must follow these conventions:
We don’t need help running automated vulnerability scanners. We’ve got those covered. We need your brainpower, not your processing power. Vulnerabilities as reported by automated tools without additional analysis as to how they're an issue won't be accepted. Please be respectful of our applications. Do not spam application forms through automated vulnerability scanners.
If you employ automated scanning tools, their requests must be rate limited to not exceed 1 request per second without prior approval. Failure to do so may be considered a DoS attack and will result in disqualification from the program.
To help us identify test traffic, please include a custom HTTP header with your HackerOne username in all your traffic: X-Hackerone: <username>. Even so, all traffic is subject to layers of defensive architecture which may automatically block anything that appears to be attack traffic.
Nothing in these Terms will be construed as creating a joint venture, partnership, employment or agency relationship between you and Visa, and you do not have any authority to create any obligation or make any representation on Visa's behalf.
All ownership rights in the Visa branded-sites listed as in Scope for this program are retained by Visa, its Affiliates and their licensors, and protected under applicable copyrights, trademarks and other proprietary (including intellectual property) rights and international treaties. All rights not expressly granted to you through these Terms are retained by Visa, its Affiliates and their licensors. Nothing in these Terms grants to you any right to use any of Visa's, its Affiliates' or any other third party's trademarks, service marks, logos or other indicia of origin. An “Affiliate” is an entity that is controlled by, controls or is under common control with Visa. Visa grants no rights to an intellectual property on any of the sites listed below and you are not permitted to create derivative works of any such websites.
You acknowledge that Visa is reliant on the representations you made to HackerOne and that all representations made to HackerOne are true and accurate.
Visa wants to encourage responsible security research and coordinated vulnerability disclosure. So, if your research, testing, and disclosure is conducted consistent with these rules:
Please note that Visa cannot and does not authorize security research or testing of any other entity’s systems or applications. If your research involves systems or applications not owned by Visa, that third party may determine whether to pursue legal action. If legal action is initiated by a third party against you in connection with activities conducted in accordance with our Rules, we will take steps to make it known that your actions were conducted in compliance with Visa’s Bug Bounty Program.
In operating this Program, Visa does not waive any rights that it may have by not exercising (or delaying the exercise of) such rights. Additionally, should you violate the Rules, Visa retains all rights and other remedies available to it at law or in equity, including the rights to seek injunctive, specific performance or other equitable relief.
Only assets listed in the Scopes table as "In Scope" are valid targets for this program. Any Visa asset not listed as "In Scope" is outside the scope of this program; testing of those assets is not authorized. Reports for assets not "In Scope" may not be eligible for bounty, even if they are accepted to be fixed.
If you have discovered a vulnerability on an asset that is not listed in scope as part of Visa’s incentivized bug bounty program and it is a Visa owned asset, please submit it to Visa’s Vulnerability Disclosure program here:
Please note that some of the assets in scope have multiple websites/URLs that share the same code base; if the same issue exists on multiple sites that share the same code base, only one report will be accepted. Similarly, only one report may be accepted for vulnerabilities that share the same root cause and fix or for systemic issues.
If you’re not sure whether a particular asset or vulnerability class is in scope, please ask us!
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
Retest Invitation: Once a fix has been deployed, Visa may invite the researcher to retest and confirm that the issue is fully fixed. Retest SLA: To maintain our remediation SLAs, researchers are required to complete the retest within 48 hours. If you cannot complete the retest with the SLA, please decline the request. Retests submitted after the 48 hour window will be considered void and ineligible for retest reward. Retest Reward: The researchers will be rewarded based on the severity of the original issue
Visa may change these Rules or cancel the Bug Bounty program at any time without prior notice. Any changes to the program or these Rules will be posted on Visa’s HackerOne site. If you continue to participate in the program after any such changes are posted, you must follow the Rules as modified.
Thank you for helping keep Visa and our users safe!