H1 HackerOne LIVE
PayPal
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- http://paypal.com/
- managed triage
- yes
- response efficiency
- 89%
- first response
- 1h avg
- time to bounty
- 2152h avg
41 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
api.loanbuilder.com | domain | yes | low | 2026-09-20 |
api.swiftfinancial.com | domain | yes | low | 2026-09-20 |
decision.swiftfinancial.com | domain | yes | low | 2026-09-20 |
loanbuilder.com | domain | yes | low | 2026-09-20 |
my.loanbuilder.com | domain | yes | low | 2026-09-20 |
my.swiftfinancial.com | domain | yes | low | 2026-09-20 |
partner.swiftfinancial.com | domain | yes | low | 2026-09-20 |
paypal.me | domain | yes | critical | 2026-09-20 |
paypalobjects.com | domain | yes | medium | 2026-09-20 |
pigeon.swiftfinancial.com | domain | yes | low | 2026-09-20 |
prequal.swiftfinancial.com | domain | yes | low | 2026-09-20 |
py.pl | domain | yes | critical | 2026-09-20 |
sandbox.braintreegateway.com | domain | yes | medium | 2026-09-20 |
scrutiny.swiftfinancial.com | domain | yes | low | 2026-09-20 |
swiftcapital.com | domain | yes | low | 2026-09-20 |
swiftfinancial.com | domain | yes | low | 2026-09-20 |
www.loanbuilder.com | domain | yes | low | 2026-09-20 |
www.swiftcapital.com | domain | yes | low | 2026-09-20 |
www.swiftfinancial.com | domain | yes | low | 2026-09-20 |
351727428 | mobile | yes | critical | 2026-09-20 |
com.paypal.android.p2pmobile | mobile | yes | critical | 2026-09-20 |
com.paypal.merchant | mobile | yes | critical | 2026-09-20 |
com.paypal.merchant.client | mobile | yes | critical | 2026-09-20 |
com.venmo | mobile | yes | critical | 2026-09-20 |
com.xoom.android.app | mobile | yes | critical | 2026-09-20 |
com.xoom.app | mobile | yes | critical | 2026-09-20 |
com.yourcompany.PPClient | mobile | no | critical | 2026-09-20 |
Braintree SDK | other | yes | critical | 2026-09-20 |
PayPal SDK | other | yes | critical | 2026-09-20 |
*.braintree-api.com | wildcard | yes | critical | 2026-09-20 |
*.braintree.tools | wildcard | yes | critical | 2026-09-20 |
*.braintreegateway.com | wildcard | yes | critical | 2026-09-20 |
*.braintreepayments.com | wildcard | yes | critical | 2026-09-20 |
*.hyperwallet.com | wildcard | yes | critical | 2026-09-20 |
*.paydiant.com | wildcard | yes | critical | 2026-09-20 |
*.paylution.com | wildcard | yes | critical | 2026-09-20 |
*.paypal.com | wildcard | yes | critical | 2026-09-20 |
*.paypalcorp.com | wildcard | yes | critical | 2026-09-20 |
*.venmo.com | wildcard | yes | critical | 2026-09-20 |
*.xoom.com | wildcard | yes | critical | 2026-09-20 |
www.paypal-*.com | wildcard | yes | low | 2026-09-20 |
7 out of scope — black ICE, don't touch
braintree.comdomainwww.gopay.comdomainwww.paypal-support.comdomaincom.paypal.heremobilecom.paypal.herehdmobile*.atlassian.netother*.paypal.cnwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.