Skip to content

PayPal Holdings Inc. - HackerOne Bounty Program

Company Profile

PayPal Holdings Inc. is an American multinational financial technology company operating an online payments system in the majority of countries that support online money transfers. Founded in 1998, PayPal serves as an electronic alternative to traditional paper methods like checks and money orders.

Wikipedia: https://en.wikipedia.org/wiki/PayPal

Corporate Overview:

  • Founded: December 1998 (as Confinity by Peter Thiel, Max Levchin, Luke Nosek)
  • Merged: March 2000 with X.com (Elon Musk's company) to become PayPal
  • Headquarters: San Jose, California, USA
  • Employees: ~30,000+ worldwide (2024)
  • CEO: Dan Schulman (2014-2023), Alex Chriss (2023-present)
  • Public Company: NASDAQ: PYPL (Spun off from eBay in 2015)

Financial Profile (2024):

  • Market Cap: ~$70 billion USD
  • Annual Revenue: ~$30 billion USD (2023)
  • Payment Volume: $1.53 trillion total payment volume (2023)
  • Active Accounts: 435+ million active user accounts
  • Merchant Accounts: 35+ million merchant accounts worldwide

Business Evolution & Major Acquisitions:

  • 1998-2002: Founded, acquired by eBay for $1.5 billion
  • 2002-2015: Operated as eBay subsidiary, dominant online payments
  • 2015: Spun off from eBay as independent public company
  • Recent Major Acquisitions:
  • Honey: $4 billion (2019) - browser extension for coupons
  • iZettle: $2.2 billion (2018) - European POS systems
  • Xoom: $890 million (2015) - international money transfers
  • Venmo: Part of Braintree acquisition - P2P payments

Key Products & Services:

  • PayPal: Core digital wallet and payment processing
  • Venmo: Peer-to-peer social payments (US-focused)
  • PayPal Credit: Buy Now, Pay Later financing
  • Braintree: Payment processing for businesses
  • Xoom: International money transfer service
  • PayPal Here: Mobile card reader and POS solutions

Financial Services Expansion:

  • PayPal Savings: High-yield savings accounts
  • PayPal Working Capital: Small business loans
  • Cryptocurrency: Buy, sell, hold crypto within PayPal wallet
  • Stablecoins: PayPal USD (PYUSD) launched 2023

HackerOne Bug Bounty Program

Program URL: https://hackerone.com/paypal
Primary Domain: paypal.com
Last Updated: 2025-09-01
Risk Level: 🟡 MEDIUM

Program Overview

PayPal operates a mature bug bounty program focused on protecting their global financial services platform. As a major financial institution, PayPal maintains stringent security controls and demonstrates sophisticated defense mechanisms across their infrastructure.

Historical Activity (6-month window)

  • Total Payouts: $600.00 (Rank #7)
  • Reports Resolved: 6
  • Average Per Report: $100.00
  • Activity Pattern: Intermittent awards including early September activity
  • Focus Areas: Financial transaction security, payment processing, user data protection

Attack Surface Analysis (2025-09-01)

Discovered Infrastructure

  • Subdomains Identified: 10 active subdomains
  • Live Web Services: 7 responsive endpoints
  • Security Posture: Financial-grade hardening with selective responses

Key Subdomains

Subdomain Purpose Security Notes
www.paypal.com Main Platform Primary payment platform
api.paypal.com API Gateway Developer and merchant APIs
developer.paypal.com Developer Portal API documentation and tools
business.paypal.com Business Services Merchant-focused services

Security Analysis

  • Financial Security Focus: Expected hardening for financial services
  • Selective Responses: Many services return filtered/protected responses
  • Professional Implementation: Evidence of mature security architecture
  • Limited Obvious Exposure: Well-protected attack surface

Notable Characteristics

  • Regulatory Compliance: Must meet financial industry security standards
  • Global Scale: International payment processing requirements
  • Multi-Service Platform: Various financial services under one umbrella
  • Developer Ecosystem: Extensive API platform for third parties

Scope Snapshot (as of 2025-09-01)

See scope.md for full policy text and breakdown.

Key Focus Areas

  • Payment processing vulnerabilities
  • Account takeover and financial fraud
  • API security for merchant integrations
  • Mobile application security
  • Cross-border transaction security

Research Priorities

Phase 1 - Payment Security

  • Transaction flow manipulation
  • Payment method bypass techniques
  • Currency conversion vulnerabilities
  • Refund and chargeback abuse

Phase 2 - API Platform Security

  • Merchant API authentication bypass
  • Developer portal vulnerabilities
  • Webhook security and replay attacks
  • Rate limiting and abuse prevention

Phase 3 - Account Security

  • Multi-factor authentication bypass
  • Account takeover techniques
  • Privilege escalation in business accounts
  • Cross-account data leakage

Notes & Intelligence

  • 2026-10-16 — new campaign-style scope item added: OTHER: Account restrictions and control bypasses - campaign appeared in the public scope (anonymous GraphQL re-check 2026-10-16, scope max_updated_at 2026-10-16T08:47:43Z; bounty-eligible). This is the first named "campaign" asset on the program — a themed focus area rather than a domain, indicating PayPal is actively soliciting account-restriction/control-bypass bugs (think feature-limitation, rate/gate, KYC-adjacent control bypasses) and likely triages them as a priority queue. Hunting read: control-bypass class findings that previously landed as generic logic bugs now have an explicit home asset — frame reports against this item. Pair with the merchant-integration origination rule below when the bypass crosses into merchant-side flows. Source: https://hackerone.com/paypal/policy_scopes
  • Policy refreshes through 2026 (program page re-check via public projection, 2026-10-15): the Overview section was last updated 2026-10-07 (prior revisions 2026-09-03 and 2026-07-16 — the program is actively churning policy text, unlike the stale 2024 rewards table beneath it). Current published terms include: min bounty $50 / max bounty $30,000 per validated submission; set-payout schedule for named classes — Subdomain Takeover: $200 (Low/Med) / $3,000 (High) / $5,000 (Critical); XSS: \(50–\)500 / \(500–\)3,000 / \(3,000–\)6,000 / \(6,000; a **separate zero-day payout structure** (percentage modifiers on standard bounties); an explicit scope clause covering **any PayPal proprietary AI/ML product or service**; and a rule that findings involving **merchants' PayPal integrations** must be submitted to PayPal's bounty first so PayPal can determine origination (PayPal-side vs merchant-side). **Hunting read: the fixed XSS/subdomain payout floors cap commodity classes at low dollars, while zero-day modifiers + the AI/ML clause mark where discretionary upside lives; the merchant-integration origination rule is a triage trap — integration bugs reported to merchants first may be disqualified.** Program stats (crawl-dated ~2026-10): ~\)13.8M total paid, ~$380K trailing 90 days, ~504 reports/90 days, 41 assets in scope, avg bounty \(1,600–\)2,500. Sources: https://hackerone.com/paypal , https://www.paypal.com/bugbounty . Rewards-table baselines still dated 2024-04-09; treat severity averages as indicative only.
  • Regulatory Environment: Must comply with PCI DSS and financial regulations
  • High Security Bar: Financial industry requires exceptional security standards
  • Global Operations: Complex international regulatory and security requirements
  • Risk Management: Sophisticated fraud detection and prevention systems

Technical Characteristics

  • Microservices Architecture: Distributed system for scalability and security
  • API-First: Extensive API platform for developers and merchants
  • Multi-Currency: Complex international payment processing
  • Real-Time Processing: High-performance transaction processing requirements

Research Considerations

  • Financial Impact: Vulnerabilities can have direct monetary consequences
  • Regulatory Scrutiny: Security issues may trigger regulatory attention
  • Reputation Risk: High-profile target with significant public attention
  • Technical Complexity: Sophisticated financial processing systems

Security Observations

  • Professional implementation with minimal obvious exposures
  • Strong filtering and protection mechanisms in place
  • Limited verbose error messages or information disclosure
  • Evidence of comprehensive monitoring and logging

Last Enumeration: 2025-09-01
Last Intel Review: 2026-10-16 (new campaign scope item: "Account restrictions and control bypasses - campaign" (OTHER, bounty-eligible), scope max_updated_at 2026-10-16; prior: 2026-10-15 policy-refresh terms)
Next Review: 2026-11-15
Analyst: Bastet Security Research Team

Current public scope

Verified public scope and policy

Historical research notes on this page are not verified authorization or current scope. Consult the linked public snapshot and the current HackerOne policy before testing.