Bug bounty program

Grab

Platform: HackerOne
Bounties: Pays
Assets in scope: 32
Disclosed reports: 20
Subdomains: 22,831

Most upvoted reports20

Most upvoted reports of Grab
Report	Weakness	Disclosed	Bounty	Votes
[Grab Android/iOS] Insecure deeplink leads to sensitive information disclosureAnalysed#401793	Cross-site Scripting	2019-03-15	–	552
www.drivegrab.com SQL injectionAnalysed#273946	SQL Injection	2017-11-17	$4,500	205
Leaking sensitive information on Github lead full access to all Grab Slack channelsAnalysed#397527	Information Disclosure	2018-09-11	–	145
Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.comAnalysed#352869	Memory Corruption	2021-02-24	$1,000	142
Leak ██████████ information in real time through API requestAnalysed#307050	Authentication	2018-02-03	$3,000	103
Access Grab_Road BigData Database via Open Presto coordinatorAnalysed#266766	Information Disclosure	2017-11-30	$5,000	97
Authorization bypass using login by phone option+horizontal escalation possible on Grab Android AppAnalysed#205000	Authentication	2017-09-14	–	68
Blind stored xss [parcel.grab.com] > name parameterAnalysed#251224	Cross-site Scripting	2017-09-14	$750	50
Two-factor authentication bypass on Grab Android AppAnalysed#202425	Authentication	2017-09-12	–	46
Git repository foundAnalysed#248693	Information Disclosure	2017-08-13	–	43

Subdomains22,831

Root:grab.com

Scope

Name suggests:Source code

First seen

Text fileClear filters13 names

Subdomains of Grab
Name	Scope	First seen
po-experiment-ui-repo-ui.grab.comgit	In scope	2026-11-14
gitlab.internal.www.edu.1f376428c.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14
gitlab.internal.api-gcp.3f376428c-api.addressedit.moveit.qms.grab.comapi, git, internal	Listed out of scope	2026-11-14
gitlab.internal.dbdiff.o69iay0p.6331f376428c.addressedit.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14
gitlab.internal.6351f376428c.6351f378427c.addressedit.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14
gitlab.internal.o69iay0p.db.moveit.qms.grab.comdata, git, internal	Listed out of scope	2026-11-14
gitlab.internal.ho-gateway.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14
ca.gitlab.internal.ho.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14
cc.gitlab.internal.ho.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14
ee.gitlab.internal.ho.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14
www.gitlab.internal.ho.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14
gitlab.internal.app.o69iay0p.o69iay0p.moveit.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14
gitlab.internal.o69iay0db.moveit.qms.grab.comgit, internal	Listed out of scope	2026-11-14

2,567 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.