H1 HackerOne LIVE
Wolt
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://wolt.com
- managed triage
- yes
- response efficiency
- 85%
- first response
- 33h avg
- time to bounty
- 275h avg
12 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
authentication.wolt.com | domain | yes | critical | 2026-09-20 |
corporate.wolt.com | domain | yes | critical | 2026-09-20 |
drive.wolt.com | domain | yes | critical | 2026-09-20 |
merchant.wolt.com | domain | yes | critical | 2026-09-20 |
ops.wolt.com | domain | yes | critical | 2026-09-20 |
restaurant-api.wolt.com | domain | yes | critical | 2026-09-20 |
wolt.com | domain | yes | critical | 2026-09-20 |
1477299281 | mobile | yes | critical | 2026-09-20 |
943905271 | mobile | yes | critical | 2026-09-20 |
com.wolt.android | mobile | yes | critical | 2026-09-20 |
com.wolt.courierapp | mobile | yes | critical | 2026-09-20 |
*.wolt.com | wildcard | yes | critical | 2026-09-20 |
12 out of scope — black ICE, don't touch
blog.wolt.comdomaingettest.wolt.comdomainhttps://merchant-onboarding-service.wolt.com/merchant-admin/inbound-merchantdomainhttps://merchant.wolt.com/api/merchant-onboarding/merchant-admin/inbound-merchantdomainhttps://merchant.wolt.com/app/partner-with-woltdomainhttps://restaurant-api.wolt.com/v1/waw-api/corporate-leadsdomainhttps://wolt.com/en/wolt-for-work-contact-requestdomainhttps://wolt.typeform.comdomainlinks.wolt.comdomainpress.wolt.comdomainwolt.atlassian.netdomain*.pipedrive.comwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.