Chime Managed Bug Bounty Engagement
Chime Managed Bug Bounty Engagement · Bugcrowd · launch date not exposed by platform
Live public bug bounty program on Bugcrowd with full safe harbor. Max payout $20,000.
Metrics
Beginner fit
76/100
Estimated: this program has a wide attack surface to explore.
Activity metrics for this program aren't exposed by the platform API, so the scores above are conservative estimates. Always verify on the program page before submitting.
Engage
Open on BugcrowdAlways read the full policy on the platform before submitting. Scope below is a summary only.
In-scope assets
- All Chime Assets
- *.chimepayments.com
- https://*.chime.com
- *.1debit.com
- *.chimecard.com
- *.chmfin.com
- *.chimebank.com
- https://www.chime.com
- https://app.chime.com
- https://play.google.com/store/apps/details?id=com.onedebit.chime
- https://apps.apple.com/us/app/chime-mobile-banking/id836215269
- https://drive.google.com/file/d/17IX06JcI2Nn7hbg9kDps5iK6oVi9U71O/view?usp=sharing
- http://member-qa.chime.com/enroll
- https://app-qa.chime.com/login
- *.saltlabs.com
Wanted categories
Who should hunt here
Beginners
Workable- 19 assets in scope gives you room to explore without fighting a crowd for the same endpoints.
- Wide attack surface — 19 assets means overlooked corners (old subdomains, staging hosts) are statistically likely.
- Fast feedback — triage lands in ~3 days, so you learn what this team pays for quickly.
Intermediate
Good target- Real ceilings — payouts reach $20k, so chaining two medium findings into one report actually pays.
- Moderate crowding: enough competition that obvious finds go fast, but systematic work on less-visited assets still pays.
Pros
High value- $20k ceiling — worth deep recon and targeted fuzzing; one critical here outearns a month of small programs.
- 19 assets scale well with automation — attack-surface monitoring and diffing pay off at this size.
Think twice if
- Bugcrowd doesn't publish report volume — the competition and fit scores here are conservative estimates, not measurements.
- Program age is unknown — Bugcrowd doesn't expose start dates, so "freshness" can't be verified.
Where these numbers come from
Live from Bugcrowd
- Max payout & safe-harbor status — from the hourly public Bugcrowd crawl
- Full in-scope asset list — crawled from Bugcrowd's public program
Modeled estimates
- Minimum bounty — not exposed; assumed $0 floor
- Report volume — unknown; competition is scored from neutral defaults
- Triage & payout speed — modeled, not measured
- Beginner fit — computed from the signals above (methodology on this page)
Recon launchpad
One-click starting points per asset — certificate history, archived pages, leaked code, and exposed hosts. Open results in their own tabs.
chimepayments.com
chimecard.com
chimebank.com
www.chime.com
app.chime.com
play.google.com