Bug bounty program

Grab

Platform: HackerOne
Bounties: Pays
Assets in scope: 32
Disclosed reports: 20
Subdomains: 22,831

Most upvoted reports20

Most upvoted reports of Grab
Report	Weakness	Disclosed	Bounty	Votes
[Grab Android/iOS] Insecure deeplink leads to sensitive information disclosureAnalysed#401793	Cross-site Scripting	2019-03-15	–	552
www.drivegrab.com SQL injectionAnalysed#273946	SQL Injection	2017-11-17	$4,500	205
Leaking sensitive information on Github lead full access to all Grab Slack channelsAnalysed#397527	Information Disclosure	2018-09-11	–	145
Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.comAnalysed#352869	Memory Corruption	2021-02-24	$1,000	142
Leak ██████████ information in real time through API requestAnalysed#307050	Authentication	2018-02-03	$3,000	103
Access Grab_Road BigData Database via Open Presto coordinatorAnalysed#266766	Information Disclosure	2017-11-30	$5,000	97
Authorization bypass using login by phone option+horizontal escalation possible on Grab Android AppAnalysed#205000	Authentication	2017-09-14	–	68
Blind stored xss [parcel.grab.com] > name parameterAnalysed#251224	Cross-site Scripting	2017-09-14	$750	50
Two-factor authentication bypass on Grab Android AppAnalysed#202425	Authentication	2017-09-12	–	46
Git repository foundAnalysed#248693	Information Disclosure	2017-08-13	–	43

Subdomains22,831

Root:grabpay.com

Scope

Name suggests:Test and QA

First seen

Text fileClear filters6 names

Subdomains of Grab
Name	Scope	First seen
test01.ips.signing.grabpay.comtest	In scope	2026-11-14
test02.ips.signing.grabpay.comtest	In scope	2026-11-14
test03.ips.signing.grabpay.comtest	In scope	2026-11-14
test05.ips.signing.grabpay.comtest	In scope	2026-11-14
qa-ambassador01.azr.grabpay.comtest	In scope	2026-11-14
test01.ips.connection.grabpay.comtest	In scope	2026-11-14

2,567 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.