Bug bounty program · HackerOne
Most upvoted reports5
- #766578ValidAbsence of Token expiry leads to Unauthorized login AccessAffirm · Authentication · 2020–155votes
- #1323406ValidIDOR to view order information of users and personal informationAffirm · Insecure Direct Object Reference · 2021$50087votes
- #1213580ValidOpen RedirectAffirm · Open Redirect · 2021$25074votes
- #1297689ValidSubdomain takeover of www█████████.affirm.comAffirm · Input Validation and Logic · 2021$50055votes
- #1312365ValidSubdomain takeover due to non registered TLD [ ██████████.█████.██████.com ]Affirm · Access Control · 2021–48votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.