Moneybox Bug Bounty
Moneybox · YesWeHack · launch date not exposed by platform
High competitionApiWebMobile
Finance/Assurance — live program on YesWeHack.
Metrics
Bounty range$50 – $2.0k
Paid this month$0
Reports12/mo
Hunters0
Beginner fit
69/100
This program gets very few competing reports.
Time to triage1d
Time to first bounty21d
Engage
Open on YesWeHackAlways read the full policy on the platform before submitting. Scope below is a summary only.
Scope assets6
Bounty floor$50
In-scope assets
- https://api.moneyboxapp.com
- https://admin.moneyboxapp.org
- https://admin-roundups.moneyboxapp.org
- https://apps.apple.com/gb/app/moneybox-save-and-invest/id1049797239
- https://play.google.com/store/apps/details?id=com.moneyboxapp
- https://sycamore.moneyboxapp.org
Fetched live from the YesWeHack API.
Wanted categories
General
Who should hunt here
Beginners
Workable- Wide attack surface — 6 assets means overlooked corners (old subdomains, staging hosts) are statistically likely.
- Fast feedback — triage lands in ~1 day, so you learn what this team pays for quickly.
- Low entry point — the bounty floor starts at $50, so lower-severity findings are still worth submitting.
Intermediate
Good target- Real ceilings — payouts reach $2.0k, so chaining two medium findings into one report actually pays.
- APIs are in scope — where medium hunters get paid: broken object-level authorization, mass assignment, and rate-limit gaps.
- Active program — ~12 valid reports/month means the triage queue is alive and templates are established.
Pros
Efficient filler- Modest for a pro — the $2.0k cap limits upside — but low crowding makes it a reliable filler between bigger programs.
Think twice if
- Heavily crowded — duplicates arrive within hours; only novel vectors or automation win here.
- Program age is unknown — YesWeHack doesn't expose start dates, so "freshness" can't be verified.
Where these numbers come from
Live from YesWeHack
- Bounty range, total report count & average first-response time — live YesWeHack API
- Full in-scope target list — fetched live from the YesWeHack program detail
Modeled estimates
- Payout speed — modeled default; the API doesn't expose time-to-bounty
- Beginner fit — computed from the signals above (methodology on this page)
Recon launchpad
One-click starting points per asset — certificate history, archived pages, leaked code, and exposed hosts. Open results in their own tabs.
yeswehack.com