Bug Bounty Program - BlaBlaCar
Comuto SA · YesWeHack · launch date not exposed by platform
High competitionApiWebMobile
CyberSec — live program on YesWeHack.
Metrics
Bounty range$50 – $3.0k
Paid this month$0
Reports107/mo
Hunters0
Beginner fit
42/100
This program triages reports within a day or two.
Time to triage1d
Time to first bounty21d
Engage
Open on YesWeHackAlways read the full policy on the platform before submitting. Scope below is a summary only.
Scope assets6
Bounty floor$50
In-scope assets
- https://edge.blablacar.(fr|de|co.uk|in|es|mx|be|hr|hu|it|nl|pl|com.br|pt|ro|ru|com|tr|com.ua))
- https://auth.blablacar.(fr|de|co.uk|in|es|mx|be|hr|hu|it|nl|pl|com.br|pt|ro|ru|com|tr|com.ua)
- https://www.blablacar.(fr|de|co.uk|in|es|mx|be|hr|hu|it|nl|pl|com.br|pt|ro|ru|com|tr|com.ua)
- https://m.blablacar.(fr|de|co.uk|in|es|mx|be|hr|hu|it|nl|pl|com.br|pt|ro|ru|com|tr|com.ua)
- https://play.google.com/store/apps/details?id=com.comuto&hl=en
- https://itunes.apple.com/fr/app/blablacar-trusted-carpooling/id341329033?l=en&mt=8
Fetched live from the YesWeHack API.
Wanted categories
General
Who should hunt here
Beginners
A stretch- Wide attack surface — 6 assets means overlooked corners (old subdomains, staging hosts) are statistically likely.
- Fast feedback — triage lands in ~1 day, so you learn what this team pays for quickly.
- Low entry point — the bounty floor starts at $50, so lower-severity findings are still worth submitting.
Intermediate
Good target- Real ceilings — payouts reach $3.0k, so chaining two medium findings into one report actually pays.
- APIs are in scope — where medium hunters get paid: broken object-level authorization, mass assignment, and rate-limit gaps.
- Active program — ~107 valid reports/month means the triage queue is alive and templates are established.
Pros
Efficient filler- Modest for a pro — the $3.0k cap limits upside — but low crowding makes it a reliable filler between bigger programs.
Think twice if
- Heavily crowded — duplicates arrive within hours; only novel vectors or automation win here.
- Program age is unknown — YesWeHack doesn't expose start dates, so "freshness" can't be verified.
Where these numbers come from
Live from YesWeHack
- Bounty range, total report count & average first-response time — live YesWeHack API
- Full in-scope target list — fetched live from the YesWeHack program detail
Modeled estimates
- Payout speed — modeled default; the API doesn't expose time-to-bounty
- Beginner fit — computed from the signals above (methodology on this page)
Recon launchpad
One-click starting points per asset — certificate history, archived pages, leaked code, and exposed hosts. Open results in their own tabs.
yeswehack.com