Bug bounty program · HackerOne
CoinMate.io
Most upvoted reports3
- #3265780ValidAdding phone number to profile By OTP brute forcingCoinMate.io · Information Disclosure · 2026 · Medium$100114votes
- #3676308ValidPOST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)CoinMate.io · Authentication · 2026 · Medium · no account (title)–93votes
- #3670955ValidHMAC signature verification omits endpoint and payload allowing request forgery on CoinMate APICoinMate.io · Cryptography · 2026 · Low–66votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.