YWH YesWeHack LIVE
ExpressVPN - Bug Bounty Program
€50 –€2,500
Open on YesWeHack ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- managed triage
- no
31 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
ExpressVPN APIs | api | · | · | 2026-09-20 |
https://api.blts.kape.com | api | · | · | 2026-09-20 |
https://api.dbs.kape.com | api | · | · | 2026-09-20 |
https://api.dts.kape.com | api | · | · | 2026-09-20 |
https://api.enc.kape.com | api | · | · | 2026-09-20 |
https://api.expressvpn.com | api | · | · | 2026-09-20 |
https://api.jwks.kape.com | api | · | · | 2026-09-20 |
https://api.pcrs.kape.com | api | · | · | 2026-09-20 |
https://cp.expressapisv2.net | api | · | · | 2026-09-20 |
https://xv-cp.apis-staging.xvtest.net/ | api | · | · | 2026-09-20 |
1pw-scim.prd.iat.it.xvservice.net | domain | · | · | 2026-09-20 |
app.expressmailguard.com | domain | · | · | 2026-09-20 |
corp.polymoon.it | domain | · | · | 2026-09-20 |
expressvpn.jobs | domain | · | · | 2026-09-20 |
gatekeeper.prd.iat.it.xvservice.net | domain | · | · | 2026-09-20 |
gh-mail.expressvpn.com | domain | · | · | 2026-09-20 |
iat.it.xvservice.net | domain | · | · | 2026-09-20 |
it.xvservice.net | domain | · | · | 2026-09-20 |
networkguard.com | domain | · | · | 2026-09-20 |
prd.iat.it.xvservice.net | domain | · | · | 2026-09-20 |
vector.prd.iat.it.xvservice.net | domain | · | · | 2026-09-20 |
Any Applications under https://www.expressvpn.com/latest | executable | · | · | 2026-09-20 |
ExpressVPN Router | other | · | · | 2026-09-20 |
ExpressVPN VPN servers | other | · | · | 2026-09-20 |
TrustedServer 100,000 Bonus Award (See Program Policy for Info) | other | · | · | 2026-09-20 |
https://github.com/expressvpn/lightway | other | · | · | 2026-09-20 |
https://github.com/expressvpn/wolfssl-rs | other | · | · | 2026-09-20 |
*.expressvpn.com | wildcard | · | · | 2026-09-20 |
*.polymoon.it | wildcard | · | · | 2026-09-20 |
*.xvservice.net | wildcard | · | · | 2026-09-20 |
*.xvtest.net | wildcard | · | · | 2026-09-20 |
1 out of scope — black ICE, don't touch
All domains or subdomains not listed in the above list of 'Scopes'other
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.